A D V A N C E S IN SAFETY A N D RELIABILITY Proceedings of the ESREL'97 International Conference on Safety and Reliability 17 - 20 June, 1997, Lisbon Portugal
Volume 1
Elsevier Science Internet H o m e p a g e -
http://www.elsevier.nl
Full catalogue information on all books, journals and electronic products.
Related Journals
Free specimen copy gladly sent on request: Elsevier Science Ltd, The Boulevard, Lang]'ord Lane, Kidlington, Oxford, OX5 1GB, U.K.
Advances in Engineering Software Computer Methods in Applied Mechanics and Engineering Computers and Fluids Computers and Structures Engineering Analysis with Boundary Elements Engineering Failure Analysis Engineering Structures Finite Elements in Analysis and Design International Journal of Solids and Structures Ocean Engineering Probabilistic Engineering Mechanics Reliability Engineering and System Safety Solids and Structures Structural Safety Thin-Walled Structures
ADVANCES IN S AFETY AND RELIABILITY Proceedings of the ESREL'97 International Conference on Safety and Reliability 17 - 20 June, 1997, Lisbon Portugal
Volume 1 Edited by C. Guedes Soares
Technical University of Lisbon Lisbon, Portugal
PERGAMON
U.K.
ElsevierScience Ltd, The Boulevard, Langford Lane, Kidlington, Oxford. OX5 1GB, England
U.S.A. ElsevierScience Inc., 655 Avenue of the Americas, New York, 10010, U.S.A. JAPAN ElsevierScience Japan, Tsunashima Building Annex, 3-20-12 Yushima, Bunkyo-ku, Tokyo 113, Japan
Copyright © 1997 Elsevier Science All Rights Reserved No part of this publication may be reproduced, stored in a retrieval system or transmitted m any form or by any means; electronic, electrostatic, magnetic tape, mechanical photocopying, recording or otherwise, without prior permission in writing from the publisher.
First edition 1997
Library of Congress Cataloging in Publication Data A catalogue record for this title is available from the Library of Congress. British Library Cataloguing in Publication Data IA catalogue record for this title is available from the British Library. ISBN 0-08-042835-5
Printed and bound in Great Britain by Redwood Books Ltd.
T A B L E OF C O N T E N T S
Volume 1 AI: Risk Based Regulations The Regulatory Review of Safety-Related Information Regarding Underground Radioactive Waste Disposal in England and Wales T h o m p s o n , B. G. J. and Williams, C.R ................................................................................................ 3
Developments and Practice Towards Risk Based Regulations in Various Technologies Berg, H. P. and Kafka, P ..................................................................................................................... 15
Incorporating Risk Assessment and its Results in the Decision-Making Process Le Guen, J. M ...................................................................................................................................... 27
A2: Risk Perception Public Perceptions of Risks Associated with Major Industrial Hazard Sites Brazier, A., Irwin, A., Kelly, C., Prince, L., Simmons, P., Walker, G. P. and Wynne, B .................. 37
Societal Risk and the Concept of Risk Aversion Vrijling, J. K. and Van Gelder, P. H. A. J. M .................................................................................... 45
From Risk Analysis to Risk Perception." Developing a Risk Communication Strategy for a DamBreak Flood Risk Lima, M. L. de, Almeida, A. B. and Silva, D ..................................................................................... 53
A3: Integrating Management Models Dynamic Modelling of Safety Management Hale, A. R., Bellamy, L. J., G u l d e n m u n d , F., Heming, B. H. J. and Kirwan, B ............................... 63
Understanding Safety Culture in Organ&ations- The Concept of Total Safety Management and its Practical use in Audit Instruments Grote, G., Kiinzler, C. and Klampfer, B ............................................................................................. 71
Case Studies with Tomhid Safety Analysis Methodology Heikkil~i, J ............................................................................................................................................ 79
A4: Safety Culture and Management Attitudes In-Depth Analysis of Organisationat Factors. The Need for Field Inquiries Llory, M ............................................................................................................................................... 89
Safety Management and Accident Prevention: the State of the Art in 14 Small and Medium-Sized Industrial Plants Seppala, A .............................................................................................................................................. 97
vi
Contents
Safety Practices and Risks Attitudes in French Small Companies Favaro, M. and Davillerd, C ............................................................................................................. 105
A5: Human Factors The Integration of Human Factors in Dependability." A Vital Aspect for Risk Management Fadier, E ............................................................................................................................................ 117
Human Errors in Maintenance Actions- An Experience Based Study Pyy, P., Laakso, K. and Reiman, L .................................................................................................. 129
Human Error and Technological Accident Prevention Ferro Fernandez, R ............................................................................................................................ 137
A6: Human Reliability State of the Art in the Development of a Simulator Aided Approach to Human Reliability Assessment Bareith, A., Hol16, E., Karsa, Z., Borb61y, S. and Spurgin, A. J ...................................................... 147
An Approach to the Human Reliability Assessment in the Context of the Probabilistic Safety Analysis of Complex Plants Kosmowski, K. T ............................................................................................................................... 155
HRA Study of Cognitive Reliability in a NPP Training Simulator Gao, J., Hang, X.-R. and Shen, Z.-P ................................................................................................ 167
A7: Operational Errors and Support Systems Rating Systems and Checklists as Tools in Development and Implementation of Environmental and Safety Management Systems Christiansen, H. C. and Hansen, E .................................................................................................... 175
Safety Program to Loss Prevention Control das Neves, J. A. and Pereira, C. M ................................................................................................... 181
Approach for Assessing Hazards Related to Hidden Deficiencies in Technical Systems Tomter, A ........................................................................................................................................... 189
A8: Expert Judgement in Safety Assessments Keejam." A Knowledge Engineering Methodology for Expert Judgment Acquisition and Modeling in Probabilistic Safety Assessment Cojazzi, G., Guida, G., Pinola, L., Sardella, R. and Baroni, P ........................................................ 199
A Practical Case of Assessing Subjective Probabilities- A Discussion of Concepts and Evaluation of Methods Andersen, L. B., Nilsen, T., Aven, T., Guerneri, A. and Maglione, R ............................................. 209
Expert Judgement in Safety Assessments Brown, D. A. and Scott, I. M. B ....................................................................................................... 217
Contents
vii
A9: Risk Management Decision Support Systems Risk Analysis and Decision Making." An Integrated Approach to Designing for Safety Tan, J. K. G .......................................................................................................................................
227
The Macro Project." Cost/Risk Evaluation of Engineering & Management Decisions Woodhouse, J .....................................................................................................................................
237
Development of a Methodology to Examine the Cost Effectiveness of Health and Safety Management Practices Priestley, K. N. and Livingston, A. D ............................................................................................... 247
A I0: Risk Management Decision Support Systems ADAM." An Accident Diagnostics, Analysis and Management System Esmaili, H., Orandi, S., Vijaykumar, R., Khatib-Rahbar, M., Zuchuat, O. and Schmocker, U ..... 257
RISMAN, a Method for Risk Management of Large Infrastructure Projects de Rijke, W. G., van der Does de Bye, M. R., Buvelot, R. and Vrijling, J. K ................................ 265
Computer Supported Event Analysis in Industry with High Hazard Potential Baggen, R., Wilpert, B., Fahlbruch, B. and Miller, R ...................................................................... 273
All: Risk Management Decision Support Systems An Information System Supporting Design for Reliability and Maintenance Rit, J.-F. and B6raud, M.-T ..............................................................................................................
281
Reliability Support System for Metallic Components Susceptible to Corrosion Related Cracking Lopes, E. Dias, Vianna, C., Carvalho, T., Schmatjko, K. J., Esmeraldo, D., Vancoille, M., van Acker, W., Boulliard, G., Phlippo, K., Jovanovic, A., Poloni, M., Bogaerts, W. and Tulp, J. 289
A Knowledge-Based System for Failure Identification Based on the HMG Method Jalashgar, A ........................................................................................................................................
297
A12: Software Reliability Software and Human Reliability Evaluation." An Experimental Attempt for a Common Approach Pasquini, A., Rizzo, A. and Veneziano, V ......................................................................................... 307
An Exponential Approximation to the Exponential- Multinomial Function Sfiiz de Bustamante, B .......................................................................................................................
315
Analysis and Recommendations for a Reliable Programming of Software-Based Safety Systems Nfifiez McLeod, J., Nfifiez McLeod, J. and Rivera, S. S .................................................................. 323
A13: Safety Critical Systems Overall Reliability Evaluation of the IEEE Benchmark Test System Using the NH-2 Program Pinheiro, J. M. S., Dornellas, C. R. R., Schilling, M. T., Melo, A. C. G. and Mello, J. C. O ........ 333
Hardware and Software Fault Tolerance." Definition and Evaluation of Adaptive Architectures in a Distributed Computing Environment Di Giandomenico, F., Bondavalli, A., Xu, J. and Chiaradonna, S .................................................. 341
viii
Contents
A Programmable Electronic System for Safety Related Control Applications Halang, W. A. and Adamski, M .......................................................................................................
349
Systemic Failure Modes." A Model for Perrow's Normal Accidents in Complex, Safety Critical Systems Collins, R. J. and T h o m p s o n , R.
357
The Essential Logic Model: A Method for Documenting Design Rationale in Safety Critical Systems Collins, R. J .......................................................................................................................................
365
A14: Software Reliability 3 P - The Product, the Process, the Processing in Software Reliability Leclercq, P. R ................................................................................ •.................................................... 375
Software Reliability Method Comparative Analysis From the Experience to the Theory Arbaretier, E ...................................................................... "................................................................
383
Subjective Safety Analysis for Software Development W a n g , J., Saeed, A. and de Lemos, R ...............................................................................................
389
A15: Software Reliability Software Reliability Prediction Recalibration Based on the TTT-Plot Z h a o , M. and Helander, M ................................................................................................................
399
Safety Monitor Synthesis Based on Hazard Scenarios G6rski, J. and Nowicki, B .................................................................................................................
407
Development of a System for a Rule-Driven Analysis of Safety Critical Software Miedl, H .............................................................................................................................................
417
BI: PSA Applications Individual Plant Examinations: What Perspectives Can Be Drawn? D r o u i n , M. T., Camp, A. L., Lehner, J., Pratt, T. and Forester, J .................................................. 425
PSA for CANDU-6 Pressurized Heavy Water Reactors." Wolsong Units 2, 3 and 4 of Korea Kim, M.-K. and Park, B.-C ...............................................................................................................
435
Level 2 PSA to Evaluate the Performance of the Doel l&2 NPP Containment Under Severe Accident Conditions D ' E e r , A., Boesmans, B., Auglaire, M., Wilmart, P. and Moeyaert, P .......................... .................. 441
R A O L - Simplified Approach to Risk Monitoring in Nuclear Power Plants Simi6, Z., O'Brien, J., Follen, S. and Mikuli6i6, V ............................................................................
449
B2: PSA Applications Relative Risk Measure Suitable for Comparison of Design Alternatives of Interim Spent Nuclear Fuel Storage Facility Ferjen6ik, M ..................................... ..................................................................................................
459
Contents
ix
Evaluation of Advanced Containment Features Proposed to Korean Standard Nuclear Power Plant Jin, Y., Park, S. Y., Kim, S. D. and Kim, D. H ............................................................................... 467
The Benefits of Symptom Based Procedures in a PSA (and vice-versa) Verweij, A. J. P. and de Wit, H. W ................................................................................................... 475
B3: Living QRA
On-Line Maintenance Scheduling and Risk Management- The EOOS Monitor ® Approach Simi6, Z., Follen, S. and Mikuli6i6, V ............................................................................................... 483
Supporting Risk Monitoring with off-line PSA Studies Vivalda, C., Carpignano, A. and Nordvik, J. P ................................................................................ 489
"Living" Safety Cases- A Team Approach Rawlinson, G. A ................................................................................................................................
497
B4: Waste Isolation Pilot Plant
Condensed Summary of the Systems Prioritization Method as a Decision-Aiding Approach for the Waste Isolation Pilot Plant Boak, D. M., Prindle, N. H., Bills, R. A., Hora, S., Lincoln, R., Mendenhall, F. and Weiner, R.. 507
Conceptual "Computational Structure of 1996 Performance Assessment for the Waste Isolation Plant Anderson, D. R., Helton, J. C., Jow, H.-N., Marietta, M. G., Chu, M. S. Y., Shephard, L. E. and Basabilvazo, G ................................................................................................................................... 515
Uncertainty and Sensitivity Analysis in 1996 Performance Assessment for the Waste Isolation Pilot Plant Helton, J. C., Anderson, D. R., Jow, H.-N., Marietta, M. G. and Basabilvazo, G ......................... 525
B5: Management of Safety Assessments
Management of Safety Assessments- Lessons Learned from Experience within National Projects Wilmot, R. D. and Galson, D. A ...................................................................................................... 535
Management of Performance Assessments in the Swedish Waste Disposal Programme." SKI's Views and Experiences Dverstorp, B., Kautsky, F., Norrby, S., Toverud, 6. and Wingefors, S .......................................... 541
Organisational and Management Issues in the Regulatory Assessment of Underground Radioactive Waste Disposal Thompson, B. G. J. and Sumerling, T. J ........................................................................................... 549
B6: Safety of Nuclear Waste Disposal
Safety Assessment of Complex Engineered and Natural Systems." Radioactive Waste Disposal McNeish, J. A., Balady, M. A., Vallikat, V. and Atkins, J .............................................................. 561
Assessing Performance of Imprecisely Characterized Systems." A Mathematical Perspective Tierney, M. S. and Rechard, R. P ..................................................................................................... 569
x
Contents
Assessing and Presenting Risks from Deep Disposal of High-Level Radioactive Waste McKinley, I. G., McCombie, C. and Zuidema, P ............................................................................. 577
B7: Safety of Nuclear Work Disposal
Parallel Computing in Probabilistic Safety Assessments of High-Level Nuclear Waste Pereira, A., Andersson, M. and Mendes, B ....................................................................................... 585
Exploring the Potential for Criticality in Geologic Repositories for Nuclear Waste Rechard, R. P ..................................................................................................................................... 593
B8: Industrial Safety
Derivation of Fatality Criteria for Humans Exposed to Thermal Radiation Rew, P. J. and McKay, I. P ............................................................................................................... 603
An Inherent Safety Opportunity Audit/Technology Options Analysis Ashford, N. A. and Zwetsloot, G ...................................................................................................... 613
Live Work Safety Audits Mendes, N .......................................................................................................................................... 619
B9: Industrial Safety
Technical Certification of Dangerous Equipment: A Study of the Effectiveness of Three Legally Compulsory Regimes in the Netherlands Hale, A. R., Pietersen, C. M., Heming, B. H. J., van den Brock, B., Mol, W. E. and Ribbert, C.. 631
Environmental Risk Assessment of Chemical Plants." A Process Systems Methodology Stefanis, S. K., Livingston, A. G. and Pistikopoulos, E. N .............................................................. 639
Process Safety Management." Performance Support and Training Systems Fiorentini, C., De Vecchi, F., Lander, E. P. and Orta, C. V ............................................................ 649
An Investigation of the Consequenciesfrom Possible Industrial Accidents in Northern Greece Ziomas, I. C., Poupkou, A. and Mouzakis, G .................................................................................. 657
B10: Industrial Safety
Using Modern Database Concepts to Facilitate Exchange of Information on Major Accidents in the European Union Kirchsteiger, C ................................................................................................................................... 667
Plant Safety Improvement by Logical-Physical Simulation Piccinini, N., Fiorentini, C., Scataglini, L. and de Vecchi, F ........................................................... 675
Planning of Component Inspection." Developments in the Netherlands Heerings, J. H. and Boogaard, J ........................................................................................................ 683
B11: Modelling Physical Phenomena
Uncertainty Quantification in Probabilistic Safety Analys& of the BLEVE Phenomenon Papazoglou, I. A. and Aneziris, O. N ................................................................................................ 693
Contents
xi
Extended Modelling and Experimental Research into Gas Explosions Mercx, W. P. M .................................................................................................................................
701
Modelling of a Low Discharge Ammonia Release Dusserre, G. and Bara, A ..................................................................................................................
709
B12: Pipeline Safety Risk Assessment of Pipelines Aneziris, O. N. and Papazoglou, I. A ................................................................................................
717
Quantified Risk Analysis in Transport of Dangerous Substances: A Comparison Between Pipelines and Roads Leonelli, P., Bonvicini, S. and Spadoni, G ........................................................................................
725
Artificial Neural Networks for Leak Detection in Pipelines Belsito, S. and Banerjee, S .................................................................................................................
733
Volume 2 CI: Offshore Safety On the Sensitivity of Offshore QRA Studies Vinnem, J. E .......................................................................................................................................
745
Details of the Offshore QRA Sensitivity Studies Vinnem, J. E .......................................................................................................................................
755
Designing Maintenance Programs for Not Normally Manned Offshore Installations A a m o d t , K. and Reinertsen, R ..........................................................................................................
763
Safety Analyses as a Too!for Safe and Cost-Efficient Design against Gas Explosions Svendsen, T ........................................................................................................................................
771
Probabilistic Modelling of Offshore Pool Fires Guedes Soares, C., Teixeira, A. P. and Neves, L .............................................................................. 781
C2: Offshore Safety Experience with Fast Track Risk Assessment Used to Compare Alternative Platforms Brandtz~eg, A. and Bea, R. G ............................................................................................................
791
Demanning or not Demanning? A Case Study Chamoux, P., Leroy, A. and Petit, A ................................................................................................
799
Methods and Models for Assessing Regularity in Gas Supply from the Norwegian Gas Network to the Markets Andersen, T., Horgen, H. and Pedersen, B ....................................................................................... 807
C3: Offshore Safety (ESRA TC) Overview of the Need for Modelling Development in Offshore QRA Studies Vinnem, J. E., Pappas, J. and Cox, R. A ..........................................................................................
819
xii
Contents
Modelling of Material Damage and Production Loss Due to Accidents on Offshore Installations Brennan, G., Vinnem, J. E., Tveit, O., Skramstad, E., Nesje, J. D., Lund, J., Kragh, E., Pappas, J., Svendsen, T., Trbojevic, V., Bjorna, J. K., Cox, T., Kinsella, K. and Hide, A ............. 829
Probabilistic Escalation Modelling Korneliussen, G., Eknes, M. L., Haugen, K. and Selmer-Olsen, S ................................................... 837
C4: Maritime Safety An Approach to Safety Assessment for Ship Structures Emi, H., Matoba, M., Yamamoto, N., Arima, T. and Omata, S ..................................................... 849
The Impact of Human Element in Marine Risk Management Gaarder, S., Rognstad, K. and Olofsson, M .....................................................................................
857
Structured Simulator Training to Improve Maritime Safety Cross, S. J ..........................................................................................................................................
867
C5: Maritime Safety R&k of Environmental Impact from a Coal Harbour Hansen, N. J ......................................................................................................................................
877
Ship-Platform Collision Risk Analysis Haugen, S ...........................................................................................................................................
885
Traffic Situation Assessment and Shore Based Collision Risk Recognition Baldauf, M .........................................................................................................................................
893
SATEST, a Method for Measuring Situation Awareness in Vessel Traffic Service Operators Wiersma, E., Heijer, T. and Hooijer, J ..............................................................................................
901
C6: Aviation Safety Aviation Systematic Safety- Worldwide Accident Review Sayce, A. G. and Doherty, S. M .......................................................................................................
909
A Framework for Setting Risk Criteria in Aviation Nicholls, D. B ....................................................................................................................................
915
An Alternative Approach to Setting Reliability and Maintainability Requirements for Combat Aircraft Appleton, D. P ...................................................................................................................................
923
C7: Aviation Safety Conditional Reliability Assessment of Aircraft Structures Pieracci, A. and Rackwitz, R .............................................................................................................
933
Decision Support for Aviation Safety Diagnostics." A Bayesian Approach Luxhoj, J. T ........................................................................................................................................
943
Aviation Systematic Safety- Occurrence Grading Scheme Sayce, A. G. and Doherty, S. M .......................................................................................................
951
Contents
xiii
C8: Railway Safety System Reliability Model for Analysing Performance of a New Railway Formaniak, A. J., Muir, I. G. S., Nanu, L. and Pickett, A. D. F .................................................... 961
Safety Communications and Management of Railway Spaces Open to the Public French, L. H ......................................................................................................................................
971
Application of a Quantified Risk Control Process Tong, D., Kwong, P. and Ho, C. W .................................................................................................
977
C9: Railway Safety Monitoring of the Railway Vehicles Availability Hudoklin, A. and Stadler, A ..............................................................................................................
987
Reliability Centered Maintenance of Signalling on French Railways (SNCF) Dermenghem, J.-P ..............................................................................................................................
995
Quantitative Risk Analysis of Industrial and Transportation Activities in the Ravenna Area: A Second Report Spadoni, G., Leonelli, P. and Egidi, D .............................................................................................
1003
C10: Automobile Reliability IAM (Intelligent Actuation and Measurement) Model and its Maintenance Relevancy for Robotic Car Assembly Zeng, S. W ........................................................................................................................................
1013
Towards an Architecture for Safety Re&ted Fault Tolerant Systems in Vehicles Dilger, E., Johansson, L. A., Kopetz, H., Krug, M., Lid6n, P., McCall, G., Mortara, P., Mfiller, B., Panizza, U., Poledna, S., Schedl, A. V., S6derberg, J., Str6mberg, M. and Thurner, T .........................................................................................................................................
1021
Using Semi-Parametric Bayesian Techniques in Reliability Validation Tasks Raoult, J. P., Gouget, N. and E1 Khair, A ......................................................................................
1031
Cll" Ship Equipment Reliability Shar&g Ships' Reliability, Availability, Ma&tainability (RAM) Information to Improve Cost Effectiveness and Safety Inozu, B., Schaedel, P. G., Roy, P. and Molinari, V ....................................................................... 1039
Economic and Reliability Aspects of Simple and Redundant Configurations for Ship Electric Propulsion Systems Pierrat, L., Fracchia, M. and Manzini, R ........................................................................................
1047
Life Assessment of CPPE's Power Plants Critical Components Goul~o, A. and Enes, J .....................................................................................................................
1057
C12: Reliability of Electronic Systems New Methods of Field Reliability Analysis & a Harsh Environment Hernandez, R ....................................................................................................................................
1067
xiv
Contents
Reliability of Electronic Components- Failure Rates Prediction Methods Bot, Y., Herrer, Y., Korenfeld, H. and Gabay, Y ........................................................................... 1075
EriView 2000- A Tool for the Analysis of Field Statistics Oscarsson, P. and Hallberg, 6 ..........................................................................................................
1083
C13: Reliability of Power Engineering Systems Power System Reliability Assessments and Applications- A Review Allan, R. N .......................................................................................................................................
1093
Reliability Analysis of Distribution Systems Considering Sub-Unavailabilities Rom{m Ubeda, J. and Rivier Abbad, J ............................................................................................
1105
Liability for Electrical Accidents." Safety and Risk Stillman, R. H ...................................................................................................................................
1115
C14: Reliability of Power Engineering Systems The New VDEW Statistics of Incidents- A Source for Component Reliability Indices of Electric Power Systems Htigel, R., Weber, Th., Lebeau, H., B6se, C. and Wellssow, W. H ................................................ 1127
Different Ways to Process Failure Statistics for Use in Reliability Analysis of Electric Power Systems Lovers, G. G. and Opskar, K. A .......................................................................................................
1135
Deterministic and Probabilistic Approaches to the Dependability of Instrumentation and Control Systems." Two Complementary Assessments in Compliance with IEC 1069 Allain-Morin, G. and Hausberger, R ...............................................................................................
1143
C15: Tools and QRA Apph'cations A Software Method for the Preliminary Definition of Maintenance on Complex Systems Components Righini, R., Bottazzi, A., Fichera, C., Kladias, N. and Perasso, L ................................................. 1155
STOPHAZ." A Support Tool for Operability and Hazard Studies Senni, S., Colombo, L. and Preston, M. L .......................................................................................
1163
Computer Simulation and Risk Analysis around Unstable Cliffs. Application to a French Case E1-Shayeb, Y., Verdel, T. and Didier, C ...........................................................................................
1171
D l: Structural Reliability and Maintenance of Bridges Optim&ation of Bridge Management Dec&ions Based on Rel&bility and Life-Cycle Cost Frangopol, D. M. and Estes, A. C ...................................................................................................
1183
Reliability Methods as a Complement to the Practice of Bridge Management Mancino, E. and Pardi, L .................................................................................................................
1195
Influence of the Fatigue Degradation and the Rheological Changes in Material on the Reliability of Bridges Sieniawska, R., Sniady, P. and Zukowski, S .................................................................................... 1203
Contents
xv
D2: Optimisation of Structural Systems
Optimal Allocation of Resources for Life-Cycle Management of Structures and Highway Networks Augusti, G., Ciampoli, M. and Frangopol, D. M ............................................................................ 1213
Development of a Maintenance Optimization Procedure of Structural Components in Nuclear Power Plants Bryla, Ph., Ardorino, F., Aufort, P., Jacquot, J. P., Magne, L., Monnier, B., Pitner, P., V+rit6, B. and Villain, B .................................................................................................................................... 1221
Optimization of Thin-Walled Girders in Probabilistic Formulation Gibczyfiska, T. and Bereza, P ...........................................................................................................
1229
D3: Stochastic Models of Loads
Stochastic Modelling of Traffic Loads for Multilane Effect Evaluation Croce, P., Salvatore, W. and Sanpaolesi, L ......................................................................................
1237
The Maximum of Stationary Non-Differentiable Gaussian Processes Breitung, K., Casciati, F. and Faravelli, L .......................................................................................
1245
Robust Reliability of Mechanical Systems Ben-Haim, Y .....................................................................................................................................
1253
D4: Simulation in Structural Reliability
Multinormal Probability by Sequentional Conditioned Importance Sampling Ambartzumian, R., Der Kiureghian, A., Ohanian, V. and Sukiasian, H ........................................ 1261
Adaptive Use of Response Surfaces in the Reliability Computations of Mechanical Components Devictor, N., Marques, M. and Lemaire, M .................................................................................... 1269
From Partial Factors Method to Simulation-Based Reliability Assessment Concepts in Structural Design de Almeida, A., Marek, P. and Guitar, M ....................................................................................... 1279
Monte Carlo Simulation Challenges in Structural Mechanics." An Approach with PROMENVIR Marchante, E. M ...............................................................................................................................
1287
D5: Time Variant Reliability
A Concept for Deriving Partial Safety Factors for Time-Variant Reliability Rackwitz, R .......................................................................................................................................
1295
Time Variant Reliability of a Reinforced Concrete Column Holick2~, M. and Vrouwenvelder, T ..................................................................................................
1307
Probabilistic Estimation of Structure Life from the Po&t of View of Safety Borg6n, J., Klimaszewski, S., Smoliflski, H. and Tomaszek, H ....................................................... 1315
xvi
Contents
D6: Structural Reliability of Dynamic Systems
Moment and Spectral Methods for Stochastic Parameter Estimation of Multi-Degree of Freedom Systems Battaini, M. and Roberts, J. B ......................................................................................................... 1323
Interval Prediction of Eigenvalues, Eigenvectors and Frequency Response Functions Teicher.t, W. H. and Sz6kely, G. S .................................................................................................... 1331
Dynamic Reliability Evaluation of Hysteretic MDF Structures Considering Parameter Uncertainties Zhao, Y. G. and Ono, T ................................................................................................................... 1341
D7: Structural Control
Model-Based Diagnosis of Structural Systems Natke, H. G ....................................................................................................................................... 1351
On Controlled L&ear Quadratic Gauss&n Systems with Contaminated Observations Romera, R. and Villagarcia, T ......................................................................................................... 1361
System Reliability Approach to Safety Analysis of Controlled Structures Battaini, M., Casciati, F. and Faravelli, L ....................................................................................... 1369
D8: Fire Safety
Risk Assessment of Building Fires Magnusson, S. E., Frantzich, H. and Kundin, J .............................................................................. 1379
Assessment of the Impact of Reliability of Fire Protection Systems on Life Safety in Buildings Yung, D. and Hadjisophocleous, G. V ............................................................................................. 1391
Fire Risk Analysis and Protective Measures for the Historic Site of Evora Serrano, M. B. and Ferreira, I. M .................................................................................................... 1399
D9: Offshore Safety (ESRA TC)
Fire Reliability of Skeletal and Plated Structures in Offshore Platforms Shetty, N. K. and Guedes Soares, C ................................................................................................ 1407
Reliability Based Factors for Fixed Steel Offshore Structural Design Efthymiou, M., van de Graaf, J. W., Tromans, P. S. and Hines, I. M ........................................... 1415
Improved Processes for Strength Assessment in the Requalification of Offshore Structures Di Cocco, N. R., Copello, S. and Piva, R ........................................................................................ 1423
Offshore Pipelines." Design Scenarios and Code Calibration by Reliability Methods Leira, B. J ............................................................. ............................................................................. 1435
D10: Offshore Safety (ESRA TC)
Overview of Probabilistic Models of the Wave Environment for Reliability Assessment of Offshore Structures Bitner-Gregersen, E. M. and Guedes Soares, C ............................................................................... 1445
Contents
xvii
Reliability Analysis of the Primary Strength of an Oil Tanker- Combination of Vertical and Horizontal Wave-Induced Load Effects Casella, G. and Rizzuto, E ...............................................................................................................
1457
Fatigue Reliability of Ship Hulls with Random Limit State Guedes Soares, C. and G a r b a t o v , Y ................................................................................................ 1467
D11: Fatigue Reliability
An Engineering Methodology for Structural Integrity Assessments Using Probabilistic Fracture Mechanics Ruggieri, C. and D o d d s Jr., R. H .................................................................................................... 1477
Fatigue Crack Monitoring in Parallel Time Scales K o r d o n s k y , Kh. and Gertsbakh, I .................................................................................................... 1485
Models for Reliability and Management of NDE Data Simola, K. and Pulkkinen, U ............................................................................................................ 1491
D12: Structural Reliability
Reliability Analysis of the Stability of Slender Structures with Geometrical Imperfections Thieffry, P., Mitteau, J. C. and Lemaire, M .................................................................................... 1501
Reliability Analysis of a Stochastically Non-Linear Structural System Rozmarynowski, B ............................................................................................................................
1509
STRAP." A Computer Tool for Structural Reliability Analysis Ciccotelli, M. and Meghella, M ........................................................................................................ 1519
Probabilistic Approach of the Tunnel Face Stability Using the Monte Carlo Procedure G a m b a , L. and C h a m b o n , P ........................................................................................................... 1527
D13: Seismic Risk and Concrete Structures
A New Statistical Model for Vrancea Earthquakes Using Prior Information from Earthquakes Before 1900 van Gelder, P. H. A. J. M. and Lungu, D ....................................................................................... 1535
The Probabilistic Evaluation of the Risk Ground Movement Rezig, S., Favre, J. L. and Leroi, E .................................................................................................. 1543
Probabilistic Modeling of Concrete Structures in Bending for Cracking Analysis Bljuger, E ..........................................................................................................................................
1551
An Application of the Material Combination Factor in the Design of RC Structures Krakovski, M. B ...............................................................................................................................
1559
D14: Variability of Material Properties
Statistical Properties of the European Production of Structural Steels Cecconi, A., Croce, P. and Salvatore, W .......................................................................................... 1567
Control of Concretes Quality Lechani, M., Ait M o h a n d , H. and Madiou, H ................................................................................ 1575
xviii
Contents
Data and Consideration on the Var&bility of Geotechnical Properties of Soils Cherubini, C ...................................................................................................................................... 1583
D15: Structural Reliability Design Combining Information in the Field of Structural Engineering Scheiwiller, A .................................................................................................................................... 1595
Probabilistic Safety Design by a Generalized Two Parameter Approach Bertrand, G. and H a a k , R ................................................................................................................
1601
Failure Estimation of Trusses by Fuzzy Sets Jendo, S. and Niczyj, J ...................................................................................................................... 1609
Volume 3 El: Uncertainty Modelling (ESRA TC) (no entries)
E2: Uncertainty Modelling MayDay. A Software Tool to Perform Uncertainty and Sensitivity Analysis. Capabilities and Applications Bolado, R., M o y a , J. A. and Alonso, A ........................................................................................... 1621
Propagation of Uncertainty in Coherent Structures F a n k h a u s e r , H. R. and R e j d e m a r k , K ............................................................................................. 1629
Intuition Theory and Risk Analysis Applications Islamov, R. T .................................................................................................................................... 1637
E3: Uncertainty Analysis On the Bayesian Approach to Risk Analysis Aven, T ............................................................................................................................................. 1647
Analysis of Uncertainty of Mechanical Components Dependability Data N o w a k o w s k i , T ................................................................................................................................. 1653
An Approximate Statistical Predictor for the Melcor Code Mira, J. and Pefia, D ........................................................................................................................ 1661
E4: Modelling Maintenance Costs A Review of the Marginal Cost Approach for Order-Replacement Models for a Spare Unit Csenki, A ........................................................................................................................................... 1671
The Cost Function for Periodically Tested Standby Units With Age-Replacement Maintenance Vaurio, J. K ...................................................................................................................................... 1681
The Zero Option Maintenance ,Strategy for Minimum Risk of Failure S m a l k o , Z., Ja2wihski, J. and Zurek, J ............................................................................................. 1691
Contents
xix
E5: Maintenance Optimisation
On the Modelling of Condition Based Maintenance Scarf, P. A ......................................................................................................................................... 1701
On the Use of Equipment Criticality in Ma&tenance Optimization and Spare Parts Inventory Control Dekker, R. and Plasmeijer, R ........................................................................................................... 1709
Availability and Spares Requirements Under the Renewal Theory for Single Repairable Units Martinez Garcia, J
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1719
A Survey on the Interval Availability Distribution of Failure Prone Systems Smith, M. A. J., Aven, T., Dekker, R. and van der Duyn Schouten, F. A ..................................... 1727
E6: Maintenance Optimisation
Probability-Based Optimization of Maintenance of the River Maas Weir at Lith van Manen, S. E., Janssen, M. P. and van den Bunt, B .................................................................. 1741
Numerical Absolute & Constrained Optimization of Maintenance Based on Risk and Cost Criteria Using Genetic Algorithms Mufioz, A., Martorell, S. and Serradell, V ....................................................................................... 1749
Modelling of Test-and Inspection Procedures." a Case Study." a Branch of an Auxiliary Feed Water System (AFWS) Tombuyses, B. and Absil, P .............................................................................................................. 1757
E7: Preventive Maintenance
Reliability Evaluation of Systems Subject to Partial Renewals for Preventive Maintenance Ch~telet, E., B6renguer, C. and Grall, A .......................................................................................... 1767
The Effect of Preventive Maintenance on Component Reliability Dorrepaal, J. W., Hokstad, P., Cooke, R. M. and Paulsen, J. L .................................................... 1775
Recent Results in Age Based Preventive Maintenance Planning Nachlas, J. A., Murdock, W. P., Degbotse, A. and Rao, N. R ....................................................... 1783
E8: Risk Based Maintenance
Maintenance Evaluation Using Risk Based Criteria Torres Valle, A .................................................................................................................................. 1793
Risk Ranking- The Opportunity for Cost Reduction Parkinson, W. J., Schloss, J. C., Hewitt, J. R., Hamzehee, H. G., Karpyak, S. D. and Tirsun, D. M ..................................................................................................................................... 1801
Risk Level Indicators for Surveillance of Changes in Risk Level Oien, K., Sklet, S. and Nielsen, L .................................................................................................... 1809
E9: Reliability Data Banks (ESReDA)
The European Industry Reliability Data Bank." EIReDA Procaccia, H., Aufort, P. and Arsenis, S .......................................................................................... 1819
xx
Contents
The ESReDA Guidebook on the Effective Use of Safety and Reliability Data with Particular Reference to "Intelligent" Selections from Raw Reliability Data Arsenis, S. P ...................................................................................................................................... 1827
Data Bank Quality Pettersson, L ............................ ........................................................................................................... 1835
Development and Use of a Directory of Accident Databases involving Chemicals Pineau, J. P ....................................................................................................................................... 1841
El0: Data Analysis
Inference from Accelerated Life Tests with Generalised Life Distribution Function and with Data Driven Selection of an Ageing Model. Maciejewski, H .................................................................................................................................. 1849
Reliability of Mechanical Components--Accelerated Testing and Advanced Statistical Methods Aug6, J.-C, Lallement, J. and L y o n n e t , P ...................... ;.................................................................. 1859
Evaluating the Effectiveness of Different Burn-in Strategies Using Field Failure Analysis N y b o r g , M ........................................................................................................................................ 1869
Ell: Data Analysis
Resampling and Bootstrap Methods in Analysis of Reliability Data Belyaev, Y. K .................................................................................................................................... 1877
Resampling and Simulation on Small-Size Samples Chevalier, M., Perez, D., Biasse, J.-M. and M i t t e r r a n d , J.-M ......................................................... 1883
Derivation of Frequency and Recovery Probabilities for Loss of Off-Site Power Accident M o r o z o v , V. B. a n d T o k m a c h e v , G. V ............................................................................................ 1889
El2: Bayesian Methods
Assessing the Failure-Rate-Prior-PDF after Component Modifications Aimed to ReliabilityGrowth Clarotti, C. A., L a n n o y , A. and Procaccia, H .................................................................................. 1897
Bayesian Prediction of Risks Based on Few and Dependent Data Bigfin, E. S ........................................................................................................................................ 1903 Costs Associated with Life Testing, Truncated After the Occurrence of a Predetermined Number r of Failures D e Souza Jr., D. I ............................................................................................................................. 1913
El3: Mathematical Methods in Reliability
Reliability Evaluation of Large Weibull Systems with Different Components K o t o w r o c k i , K .................................................................................................................................. 1923
Approximation of the Reliability of Large Scale Systems with Random Number of Components S m o l a r e k , L ....................................................................................................................................... 1931
Contents
xxi
Explicit Shape of the Status and Reliability Functions of Any System M a r t i n e z Garcia, J ............................................................................................................................ 1937
Optimal Replacement Times for Systems of Multiple and Single Use K o p n o v , V. A ................................................................................................................................... 1947
Statistical Method Based on the Weibull Distribution to Estimate the Life-Length of Banknotes Le6n, F .............................................................................................................................................. 1957
El4: Reliability and Stochastic Processes Control
A Simple Definition of Risk and Its Control Charts Girmes, D. H .................................................................................................................................... 1967
A Note on Safety, Reliability and Control of Systems von Collani, E ................................................................................................................................... 1977
Applications of Some Reliability Models Considering Covariates K u m a r , D. and Westberg, U ............................................................................................................ 1985
El5: Education and Training
Centre for Dependability and Maintenance at LuleCt University of Technology- A Way to Improve Research and Education. Klefsj6, B. and K u m a r , U ................................................................................................................ 1995
Stochastic Process Control and Quality Management R a m a l h o t o M. F. and G u e d e s Soares, C ......................................................................................... 2003
An Interesting Real Problem to Teach Simulation Techniques to Engineering Students Villagarcia, T. and R o m e r a , R ......................................................................................................... 2011
FI: Systems Dependability
Using the Constraint Programming System Toupie for Qualitative Analysis of Industrial Systems Failures Lajeunesse, S. and R a u z y , A ............................................................................................................ 2021
Modeling the Operating Environment Effects on Phsyically-Connected Redundant Components Marseguerra, M., P a d o v a n i , E. and Zio, E ...................................................................................... 2029
F2: Fault Tree Analysis
Better Fault Tree Analys& Via Sequential Modularization Schneeweiss, W. G ............................................................................................................................ 2039
BDD Based Fault-Tree Processing." A Comparison of Variable Ordering Heuristics Bouissou, M., Bruy~re, F. and R a u z y , A ......................................................................................... 2045
RAMS Computation Algorithms using the Set of Good Paths of the System Lardeux, E ......................................................................................................................................... 2053
xxii
Contents
F3: Boolean Modelling
Handling Boolean Models with Loops Dutuit, Y. and Rauzy, A .................................................................................................................. 2063
An Easy-to-Implement Efficient Algorithm for Solving the Terminal Pair Reliability Problem Schneeweiss, W. and Wirsching, J .................................................................................................... 2071
Pseudo-Boolean Approach to Solving Reliability Problems Rai, S. and Trahan, J. L ................................................................................................................... 2079
F4: Dynamic Reliability
Method to Divide Dynamic Systems into Independent Sub-Systems for Reliability Computation Duhesme, E. and Laleuf, J.-C ................................................... i ....................................................... 2089
On the Application of the ISA Methodology to the Study of Accident Sequence Precursors Mel6ndez Asensio, E., P6rez Mulas, A. and Izquierdo R o c h a , J. M ............................................... 2097
Role of Time Delays in Event Trees Dessars, N. and Devooght, J ............................................................................................................ 2105
F5: Monte Carlo Methods in Reliability
Parameter Estimates for Monte Carlo Simulation of Contaminant Transport in Groundwater Marseguerra, M. and Zio, E ............................................................................................................. 2115
Variance Reduction for Simultaneous Monte Carlo Estimation of Many Markovian Unreliability Functionals Delcoux, J. L .....................................................................................................................................
2123
Variance Reduction Techniques in Monte Carlo Simulation Applied to Dynamic Reliability Labeau, P. E .....................................................................................................................................
2129
Using D&crete Event Simulation in Rel&bility Analysbs Eisinger, S .........................................................................................................................................
2139
F6: Semi-Markov Analysis
ph-Distribution Method for Reliability Evaluation of Semi-Markov Systems Bousfiha, A. and Limnios, N ............................................................................................................ 2149
Application of Transport Equations to Model Reliability Problems of Dynamic Systems Becker, G., Camarinopoulos, L. and Micheler, M ........................................................................... 2155
Availability Analysis of a 1-out-of-2:G Non-Markovian System Operating under Fluctuating Environment Agarwal, M. and Chaudhuri, M ....................................................................................................... 2163
F7: Modelling Dependent Failures
Modeling Stochastically Dependent Failures Marseguerra, M. and Zio, E ............................................................................................................. 2173
Contents
xxiii
Searching for Systemic Failure Modes Collins, R. J. and T h o m p s o n , R ....................................................................................................... 2181
VVER Specific Common Cause Failure Data Tokmachev, G. V ..............................................................................................................................
2189
F8: Reliability of Degrading Systems
Reliability Analysis of Degraded System Configurations Vahl, A ..............................................................................................................................................
2197
Simulator for Estimating Reliability of a System Subject to Imperfect Repair Lie, C. H., Hong, J. S., Kim, T. W., Baek, S. Y. and Lim, T. J ..................................................... 2205
Reliability Analysis of Non-Repaired Multistate Systems Korczak, E ........................................................................................................................................
2213
F9: Reliability in Networks
An Overview of Methodologies for Reliability Analysis of Multiexchange Networks Craveirinha, J. and Gomes, T ........................................................................................................... 2223
A Simulation Approach to the Estimation of Cutoff Connection Rate in the A TM Switching System Jeong, M. K., Koh, J. S. and Choi, S. H ......................................................................................... 2233
An Improved Method for Network Reliability Analysis Shen, Y.-L. and Tao, C.-X ............................................................................................................... 2239
Quantifying the Fault Tolerance of Multiple-Bus Based Systems Schneeweiss, W. G. and Kfifner, H .................................................................................................. 2247
F10: Petri-Net Analysis
Analysis of a Sequential Non Coherent and Looped System with Two Approaches." Petri Nets and Neural Networks Pasquet, S., Chf~telet, E., Thomas, P. and Dutuit, Y ....................................................................... 2257
Application of Petri-Nets-Based Method for Reliability Analysis of NPP Safety System Petkov, G. I .......................................................................................................................................
2265
Time-Dependent Availability Analysis for Ship Electric Redundant Propulsion Systems Using Petri Nets Pierrat, L. and Fracchia, M .............................................................................................................. 2275
Fll: Dependability of Robot Systems
Failure Detection, Isolation and Recovery System Concept for the European Robotic Arm Bos, J. F. T. and Oort, M. J. A ........................................................................................................ 2285
Developing the Safety Case for Large Mobile Robots Seward, D., Quayle, S., Somerville, I. and Morrey, R ..................................................................... 2293
Failure Diagnosis and Analysis for an Autonomous Underwater Vehicle Christensen, P., Lauridsen, K. and Madsen, H. O ........................................................................... 2301
xxiv
Contents
FI2: Reliability in Design Sensitivity of Passive System Behaviour Ricotti, M. E. and Zio, E .................................................................................................................
2311
The Utility of Passive Systems for Safety and Reliability Spray, S. D. and Cooper, J. A ..........................................................................................................
2321
Improving Systems' Dependability Agarwal, J., Blockley, D. I. and Woodman, N. J ............................................................................ 2329
F13: Reliability in Design Modelling Reliability Growth Through Innovation Ansell, J. I. and Phillips, M. J ..........................................................................................................
2341
A New Analysis Method for Reliability Design." Computational Graphic Modeling Karasawa, S., Nojo, S. and Watanabe, H ........................................................................................ 2353
Reliability Apportionment for Systems with Nonexponential Time to Failure Jaeger, M., Porat, Z. and Tzidony, D .............................................................................................. 2361
Probabilistic Reliability in Machine Tool Design Jia, Y., Cheng, X. and Jia, Z ............................................................................................................
2367
F14: Case Studies of Systems Reliability A Case Study on Reliability Analysis of a Multiexchange Telecommunication Network Gomes, T., Craveirinha, J., Baeta, I., Santos, R. and Pereira, J ...................................................... 2377
Reliability Analysis of Service Water Pumps by Poisson Point Processes with a Generalized Model for the Rate of Occurrence of Failures Saldanha, P. L. C., de Simone, E. A. and Frutuoso e Melo, P. F .................................................. 2385
Safety Analysis in Operation and Design of Open Pit Machines Mlynczak, M .....................................................................................................................................
2393
F15: Fuzzy Set Modelling Applications of Fuzzy Inference Methods to Failure Modes Effects and Criticality Analysis (FMECA) Kara-Zaitri, C. and Fleming, P. V .................................................................................................... 2403
Fault Tree Analysis with Fuzzy Failure Rates Comotti, D., Di Giulio, A., Ghisleni, T., Sinisi, M. and Uguccioni, G ........................................... 2415
The Limited Applicability of Fuzzy Set Theory to Fault Tree Analysis--Negative Probabilities and other Anomalies Bischoff, K. and Bretschneider, M ................................................................................................... 2423
PREFACE
These volumes comprise the papers presented at the ESREL'97 Conference. The purpose of the ESREL Conferences is to provide a forum for the presentation of technical and scientific papers covering both methods and applications of safety and reliability to a wide range of industrial sectors and technical disciplines enhancing cross-fertilisation between them. A broad view is taken of safety and reliability which includes essentially probabilistically based methods, or more generally, methods that deal with the quantification of the uncertainty in the knowledge of the real world and with decision making under this uncertainty. The areas covered range from design and product liability, to availability, reliability and maintainability, to assessment and management of risks to technical systems, health and the environment and to mathematical methods of reliability and statistical analysis of data. The annual ESREL Conferences stem from an European initiative merging several National Conferences into a Pan-European Safety and Reliability event under the auspices of ESRA, the European Safety and Reliability Association. ESRA started up in the late 1980's by the European Commission and in 1992 it was established in Brussels as a non-profit making International Association, aiming at the advancement and application of Safety and Reliability technology in all areas of activity. ESRA strives to establish co-operation and mutual exchange of information between national and international professional societies, standard setting organisations, industry and research groups, aiming at the advancement of the methods and applications of Safety and Reliability. The ESREL Conferences started from National Conferences in France and the United Kingdom, Xla7 in Brest in 1990 and REL'91 in London. From 1992 onwards, they acquired a more European dimension and they have been held successively in Copenhagen, Munich, La Baule, Bournemouth and Crete from 1992 to 1996, the latter in co-operation with IAPSAM. The 1997 Conference is organised by Instituto Superior T6cnico of the Technical University of Lisbon. The technical programme has been the responsibility of an International Committee of about 50 specialists from different countries, industries and technical disciplines that have reviewed the abstracts and then the full papers, prior to their final acceptance. The starting point has been 510 abstracts from which 310 have been accepted, from which 270 papers have been included in these proceedings for presentation at the Conference. It is important to stress that the present conference has, in fact, gone beyond the European dimension insofar as it includes papers with authors from 35 countries, 15 of which are non-European. The organisation of the books follows closely the sessions of the Conference, which in turn is based on six parallel sessions. Each of the three volumes of the proceedings contains the papers from two parallel sessions. XXV
xxvi
Preface
The first session deals with Risk Management, including aspects of risk perception, safety culture, human factors and decision support systems. In addition it includes topics of software reliability and of safety critical systems. The second session concentrates on applications of quantified risk assessment to the nuclear industry and to industrial safety. The second volume includes a session dealing mainly with transportation safety, including aviation, railway, automobile and maritime as well as aspects of offshore safety. It also covers aspects of reliability of electronic and power engineering systems. The other session deals mainly with aspects of structural reliability, which cover assessment methods, the modelling of loads and material properties, as well as applications to different types of structures such as bridges, buildings, concrete structures, highway systems, offshore and ship structures. The last volume includes sessions on reliability based maintenance and on systems dependability. The first of the two sessions has papers on uncertainty modelling, on maintenance and on statistical analysis of data. The other includes topics such as fault-tree analysis, dynamic reliability, boolean and semi-markov analysis and reliability in design. It is hoped that such a wide programme will ensure that the conference fulfils its aim of being a forum for engineers, scientists, managers and regulators linked to different industries and technical disciplines to meet and exchange their knowledge and experience in the field of safety and reliability engineering. In concluding, I would like to thank the authors and all those who have contributed to the organisation of the conference. In particular the members of the advisory board, the technical programme committee, the session organisers and chairpersons, the local organising committee and the conference secretariat. All have contributed to the final outcome of the conference and to the contents and organisation of these books. Carlos Guedes Soares ESREL '97 Conference Chairman
The 1997 Annual ESRA Conference
Organised by Instituto Superior T6cnico
in Collaboration with ESRA- European Safety and Reliability Association ESReDA Danish Risk Assessment Society Institute of Quality Assurance Institut de Suret6 de Fonctionnement Norwegian Association for Risk and Reliability Analysis Ordem dos Engenheiros SRE- Scandinavian Chapter The Safety and Reliability Society VDI-GSP - Verein Deutscher Ingenieure 3 ASI Associazone degli Analisti di Affidabilit/l e Sicurezza
Sponsored by Commission of the European Communities Fundag~o Calousten Gulbenkian Junta Nacional de Investigag~o Cientifica e Tecnol6gica xxvii
This Page Intentionally Left Blank
ESREL'97 Conference Chairman c. Guedes Soares, PT
Advisory Board D. Harvey, UK l.Watson, UKP. Kafka, DEM. Cottam, UK K. Petersen, DKP.R. Leclercq, FI. Papazoglou, G
Technical Programme Committee J. Anselmo, B T. Aven, N I.C. Bacivarov, RO J.F. Barbet, F A. Bareith, HG P. Barrett, UK G. Becker, DE J. Biemat, PL A. Birolini, CH D.I. Blockley, UK M. Brown, UK L. Camarinopoulos, GR C.A. Clarotti, I R. Cooke, NL M. Cottam, UK J. Craveirinha, PT C. Dennis, UK
J. Devooght, B M.S. Elzas, NL E. Fadier, F L. Faravelli, I T.A.W. Geyer, UK T. Gulbrandsen, N A.R. Hale, NL L. Harms-Ringdahl, SE M. Holick~, CZR J. Holmberg, FN A. Hudoklin, SL R. Islamov, R P. Kafka, DE B. Klefs6, SE K. Kolov~Tocki,PL H. Kortner, N P.R. Leclercq, F
V. Leg~it,CZ M. Lemaire, F B. Littlewood, UK D. Lungu, RO S. Lydersen, N M. Marseguerra, I B.R. Martin, UK S. Martorell, E I.G. McKinley, CH J. Moltoft, DK R. Nevell, UK M. Newby, UK I. Papazoglou, GR A. Pasquini, I P.PY2¢,FN K.E. Petersen, DK C. Pietersen, NL
H. Procaccia, F R. Rackwitz, DE J-F. Raffoux, F M.F. Ramalhoto, PT M. Raasand, N V. Rouhiainen, FN A.S. Bustamante, E G.I. Schu~ller, A W. Schneeweiss, DE A. Seppala, FN J-P. Signoret, F P. Sniady, PL A. Sols, E B.G.J.Thompson, UK J.K. Vaurio, FN J.E. Vinnem, N E. Wolfgang, DE
Session Organisers T. Aven E. Fadier A.R. Hale L. Harms-Ringdahl J. Holmberg
P. Kafka J. Moltoft M. Newby I. Papazoglou A. Pasquini
K.E. Petersen R. Rackwitz V. Rouhiainen W. Schneeweiss
J.P. Signoret B.G.J. Thompson J.K. Vaurio I. Watson
Local Organising Committee A. Augusto Femandes P. Mendes
J.F. Craveirinha R. Teixeira Duarte
A.P. Teixeira V. Gonqalves Brito
Col~erence Secretariat M. F,'itima Pina, Cristina Ribeiro, Sandra Robalo xxix
M. Bouza Serrano M.F. Ramalhoto
This Page Intentionally Left Blank
AI" Risk Based Regulations
This Page Intentionally Left Blank
THE REGULATORY REVIEW OF SAFETY-RELATED INFORMATION REGARDING UNDERGROUND RADIOACTIVE WASTE DISPOSAL IN ENGLAND AND WALES B G J Thompson, and C R Williams The Environment Agency of England & Wales
ABSTRACT This paper builds upon earlier related contributions to the ESREL/PSAM Conference series and elsewhere, to outline the nature of a safety case based upon probabilistic risk analysis and the options for its assessment by a regulatory authority. Much has been published since the late 1970's, concerning the methods and tools used to perform technical analyses of radiological performance for any single party in a democratic society. However, little attention seems to have been given in the literature to the way in which such analyses, undertaken independently by a regulator, are best used to probe the safety case and its underlying arguments in a coherent and traceable manner. Recent experience from the review of preliminary safety-related information for a proposed deep repository in England indicates that further consideration should be given to the regulatory methodology, to possible difficulties due to oversimplified analyses, and to careful preparation for Public Hearings.
m~vwoans Regulation, risk, assessment, radioactive waste disposal, probabilistic risk assessment, public decision making, decision analysis, Her Majesty's Inspectorate of Pollution, HMIP.
INTRODUCTION
Papers published in the earlier ESREL/PSAM international conferences, for example Thompson (1994), Steam (1994), Sumerling and Read (1994), Thompson, Smith and Porter (1996), Ashworth and Porter (1996) and others, provide an ongoing account of the development and application of the post-closure risk assessment capability of the Environment Agency1, in connection with its duties to regulate the underground disposal of solid low and intermediate level radioactive wastes. The present paper builds upon the arguments advanced in these related contributions, and elsewhere, to outline the nature of a safety case based upon probabilistic risk analysis, and the options for its assessment by a regulatory authority. Although this experience has been related specifically to nuclear waste disposal, the general principles and methods outlined, together with issues of concern, should be of interest to those constructing safety-related arguments in other application areas. This paper is intended to underpin a complete session on risk-based regulation at ESREL '97, therefore.
1 Originally carried out by Her Majesty's Inspectorate of Pollution (HMIP) which, on 1 April 1996, became part of the Environment Agency of England and Wales.
4
B.G.J. Thompson and C.R. Williams
THE REGULATORY CONTEXT In the United Kingdom, no person may dispose of radioactive waste except in accordance with an authorisation under the Radioactive Substances Act 1993 (RSA93), except where the waste is excluded by the Act or by an Exemption Order. The developer of a deep repository, referred to below as "the proponent", will be required to apply to the relevant Agency - namely the Environment Agency for a site in England and Wales, or the Scottish Environment Protection Agency for a site in Scotland - for authorisation of disposals on or from the repository site. Authorisation under RSA93 would include both the emplacement of the primary solid waste, without intent to retrieve it at a later time, and the discharges of any secondary liquid or gaseous radioactive arisings. There is no statutory requirement for the proponent to make an application for an authorisation under RSA93 at any particular time, although he must have such an authorisation actually to dispose of radioactive waste. The proponent may choose to make an application to the Agency early in his programme, or much nearer the time that waste is to emplaced. The proponent is solely responsible for preparing and presenting the Agency with a satisfactory safety case, as part of an application for authorisation. The Agency is responsible for examining the quality of the scientific basis of this case, the way in which it has been applied, the quality and traceability of the data used, the way in which uncertainties have been treated, and, eventually the conclusions offered by the proponent in regard to the safety of the proposed disposal arrangements. A proposed repository would require planning permission under the Town and Country Planning Act 1990, in addition to authorisation under RSA93. Planning applications are made to the local planning authority- but in the case of a proposed repository, the application would be called in by the relevant Environment Secretary of State and a public inquiry will be held. The Agency is likely to be asked to provide the inquiry with a technical view on the proponent's proposals which is both informed and independent. HM Nuclear Installations Inspectorate (HMNII) of the Health and Safety Executive is responsible for the safety of operations on nuclear licensed sites as defined in the Nuclear Installations Act 1965. While the present paper is not concerned with those operational nuclear safety aspects, it may be noted that any future repository would be a nuclear licensed site, and that the Agency would consult and cooperate with HMNII to ensure that the requirements of each regulatory organisation would be met by the proponent.
THE PROCESS OF REGULATORY ASSESSMENT The nature of the safety case
A safety case may conveniently be considered as comprised of four related aspects: (a) A knowledge base of repository design, waste characteristics and quantities proposed for disposal, the information from the geological and other parts of the site-specific investigations, all set against the wider scientific and technical source literature. This may be sub-divided into: (at) (a2)
general information, possibly reviewed and agreed beforehand, including released computer software, development and test details and quality regime, and site-specific information and repository-specific information that comes only from the proponent and must be reviewed with a separate time-table.
(b) The description of the trace of all decisions, assumptions etc .... made during the development of the safety argument. This may be visualised as an decision or logic 'tree' or perhaps a 'graph'. It should make clear the use of evidence and judgements in a clear, explicit manner that allows the results from the safety calculations to be traced back to source in a justifiable manner. Each assumption may be a potential cause of bias on the results of orthodox calculations, and a means of evaluating these biases is necessary. See Thompson, Gralewski and Grindrod (1995).
Advances in Safety and Reliability: ESREL '97
5
(c) The quantitative analyses themselves, commonly termed the 'performance assessment', with their resulting estimates under uncertainty of radiological doses and risks during the long-term post-closure period. Other regulatory decision variables may be considered also, Environment Agency et al (1997). The Royal Society believes that these are usually less satisfactory than dealing directly with radiological risk, however. See Royal Society (1994). (d) Depending on the stage of the regulatory process, and the overall level of understanding gained to support the case, it may also be necessary to supply further arguments. These arguments would seek to justify that the proposed further information gathering from site investigation, further design work and/or the results of research and development generally, will reduce ignorance, and will clarify the current uncertainties. This is the problem of 'How much information, and of what kind, is sufficient to provide confidence in the analysis?' This is also called the 'information closure' problem. See, for instance, Bonano and Thompson (1993). Recapitulating on the previous ESREL '96/PSAM III conference papers, as summarised by Thompson, Smith and Porter (1996), the experience in the UK suggests that there are three main stages of work leading to possible authorisation for disposal of solid low and intermediate level radioactive wastes: Stage I: Developing a system model-based method of assessment employing Monte Carlo simulation to account for uncertainties. However, industry had never submitted its own safety cases to HMIP who necessarily had, therefore, to construct different surrogate 'cases' for hypothetical facilities to indicate what might be expected, at that stage of the subject, in a safety argument. Stage 2: A proponent is likely, at an intermediate state of site investigation and of the associated research programme, to submit a planning application to construct a deep repository. The long-term safety arguments will be made on the basis of a so-called detailed Environmental and Radiological Analysis (DERA). A large-scale Public Inquiry will be held at a venue local to the proposed site. By definition, the safety case will be based on interim information. Regulators will need, therefore, to be satisfied on all four aspects outlined earlier before offering a provisional view concerning possible future authorisation. Stage 3: In due course a Final Environmental and Radiological Analysis (FERA) will be submitted for authorisation to dispose of wastes under the Radioactive Substances Act (1993). In contrast to the DERA to be submitted in Stage 2, the FERA should not require further examination of fundamental scientific or engineering issues, and should provide a robust safety argument. Further work to confirm the safety case - within the same conceptual flame as that provided in the FERA - is likely to be required as the repository is operated over a period of perhaps 50 years, and will involve regular re-assessments as a basis for permitting continued emplacement of waste and other aspects of repository operation (e.g. backfilling vaults) to proceed.
Options for regulatory assessment Broadly, during Stages 2 and 3, a regulator could adopt one of four levels of assessment capability: (i) Purely responsive; awaiting, according to a general programme, the arrival of each submission from the proponent, and only then taking action to seek independent review from in-house or external expertise. (ii) Maintaining a continuing awareness of the subject through a Panel of Experts who can prepare themselves for a more thorough review on the basis of a general research programme. This is termed the Scientific and Technical Review (STR) capability and includes review of both repository engineering and site characterisation.
6
B.G.J. Thompson and C.R. Williams (iii) In addition to the STR, introducing some ability to check the quantitative aspects of the submission by developing and maintaining expertise, independent of the proponent, in computational modelling etc .... At least being able to re-run sottware to verify the calculations performed within the proponent's own general assumptions reviewed under approach (ii). (iv) In addition to the capability of level (iii) developing and applying a completely Independent Performance Assessment (IPA) capability including methods for decision tracking and bias evaluation. This latter approach was adopted by HMIP, Thompson (1994).
Option (iv) preserves regulatory options for any specific application in the future. However, it has never been intended that UK regulators should produce a full safety case. That safety case is entirely the responsibility of the proponent, but it is difficult for the regulators to judge such a case without knowledge of what is involved based on "hands-on" experience of carrying out essential aspects of a safety analysis. RECENT ASSESSMENT-RELATED EXPERIENCE The second stage of the process is under way after a period of site investigation by the proponent. It was expected originally that the proponent would submit a planning application for repository construction in Autumn 1992, leading to a Public Inquiry in 1993/94. In response to this HMIP, following a comprehensive contract tendering process during 1991, commissioned two lead contractors to undertake assessments of safety documentation, and to provide support during the Inquiry hearings. These two principal contracts were:
The Scientific and Technical Review (STR) and the; Independent Performance Assessment (IPA) project; and these were assisted by two further contracts; Assessment Information Management System (AIMS), to provide a bibliographic database and regulatory correspondence logging procedure; and the Quality. Assurance (Q) contract, to review and extend the existing QA/SQA system and its documentation and to review the proponent's approach as required. Although no formal application to dispose of wastes would have been expected at the time of the Inquiry hearings, HMIP would have been required to give a provisional view as to the likelihood of such an authorisation being granted in due course once the full site study had been completed and a FERA safety case submitted during the third stage outlined above. Under the Scientific and Technical Review, detailed reviews of preliminary safety-related documentation were conducted by a panel of recognised experts, covering about twenty different disciplines. This helped HMIP to understand better how to conduct such reviews and to document them. It has also, we believe, been of help to any proponent to learn from this first experience of being exposed to such a critique, especially with regard to issues such as the traceability of results and conclusions back, through a chain of assumptions and decisions, to source literature and data. The Independent Performance Assessment project produced two partial post-closure, probabilistic systems analyses (PSA) based upon early site data and other information. During a first phase of work (February 1992 to April 1993) a simple PSA was completed for steady-state conditions, based on current climate. This central activity was augmented by a number of ancillary studies aimed at developing understanding of the site-specific effects of certain key processes. This was followed by a second phase of work (May 1993 to September 1994) that focused on the hydrogeological performance of the site and the release and transport of radionuclides in groundwater. Twodimensional and fully three-dimensional groundwater models were constructed using the NAMMU finite element software although the available data were still too limited for reliable calibration of these models. A number of scoping calculations were carried out for both present day and for a wide range of possible future site conditions (based on likely changes in climate, interpreted from records of the Quaternary period). These calculations explored the implications of the uncertainty at that time in our knowledge of the spatial configuration of major faults and the stratigraphy of the site and of the associated hydrogeological properties and boundary conditions, together with the uncertainty over their changes with time.
Advances in Safety and Reliability: ESREL '97
7
Even under present-day climatic conditions, assumed to be preserved over the long-term post closure period, some three-dimensional calculations indicated, as shown for instance in Fig. 1, that a plume of contaminant could deviate from the two-dimensional vertical section assumed in earlier estimates. PRESENT DAY COASTLINE
,,
\/
o,oooyo s "~lg 6 PROPONENT'S GROUNDWATER., MODEL SECTION
.
NOTIONAL
\,
R
OSlro Y
( ~
~'0"~m, ['
~ 300,000years
I O D I N E 129 PLUME TRAJECTORY
CONCENTRATIONCONTOURSAT 100m.BOD, TRANSIENTCALCULATION,'BEST ESTIMATE'FAULTS.
Figure 1. Estimated movement of contaminant assuming constant present-day climate. A "state-of-the-art" PSA was then carried out using the TIME4 and VANDAL Monte Carlo simulation software, Thompson and Sagar (1993), incorporating a fully three-dimensional groundwater flow and radionuclide transport model, that evolved over time under the influence of climate-driven changing surface boundary conditions (for instance, topographical changes, sea level, recharge etc). Statistical convergence of the sample mean dose (H) was well indicated after 940 realisations, using Simple Random Sampling, as the results over a period of 500,000 years show in Figure 2 which also compares the risks from the 95 %ile dose (Ho 95), and from the realisation yielding the highest peak dose ( ~ .
,~
10,000
t~FI'M,x 'WORST CASE' ~H / .
1,000
.
-
J
I
•
•
/
/ 100
f
/~
10-
~Ho95 95% ILE ~ ~ _..
f
I
/
-
~
~
!
RELATIVE ANNUAL 'RISK'
~rr ~.
"
_
-
-_.
-
GUTI34AN 90% CONFIDENCE INTERVAL
I
IODINE 129; DRINKING WATER PATHWAY; HYPOTHETICAL EXPOSED GROUP ABOVE REPOSITORY.
1-¢
0
I
100,000
Figure 2. Comparison of different risk estimates.
I
'
/
YEARS AFTER CLOSURE
I
500,000
8
B.G.J. Thompson and C.R. Williams
Figure 3 comparesthe results from the simple Phase 1 simulation, with the estimates obtained during Phase 2, of "mean risk" (yH) for different surface locations of a hypothetically exposed group drinking water from a sampling well. ~H
RELATIVE ANNUAL INDIVIDUAI'I0 0 _ RISK
LOCATION OF HYPOTHETICAL EXPOSED OROUP: B /
BASED
ABOVE REPOSITORY FOOTPRINT
"~ ~
/
/
UPON ARITHMETIC
I /
MEAN DOSE
. . . . . . . . . .
I [
10 - -
I I
A
~
NEAR PRESENT COASTLINE
C 1.0--
" " " ~ -
J
0.1--
SOUTHWEST REPOSITORY
OF
P H A S E 2: T H R E E - D I M E N S I O N A L FLOW; CLIMATE CHANOE P H A S E 1: T W O - D I M E N S I O N A L FLOW; PRESENT CLIMATE
-.y
0.01 --
,, N E A R
0
I 1
I 2
PRESENT
I 3
t 4
COASTINE
I 5
xl0
5
YEARS AFTER C~-OSURE--
Figure 3. Illustrative results from Monte Carlo analysis of groundwater pathway. The work concluded with an evaluation of "internal bias", see Thompson, Gralewski and Grindrod (1995), by a series of further detailed finite element calculations performed within a fractional factorial experimental design to give a first order estimate of the combined influences of five factors omitted from the Phase 2 PSA simulation. The influence on the sample mean, and the 95 %ile estimates was inferred broadly, as shown in Figure 4, from evaluation points (X, Y and Z). The sources of potential bias were elicited in group sessions and recorded on a relational database. The latter was used to ensure full traceability of the chain of decisions taken at different stages of an assessment, Grindrod (1996). DISCUSSION OF ISSUES A number of issues of potential regulatory concern can be highlighted on the basis of this experience to date: The Possible Dangers From Oversimplified Analyses In the interests of communicating to and convincing as wide an audience as possible, it is desirable to find the simplest and most robust arguments to justify any safety case. However, experience indicates that this desire may lead to a dangerous naivety. The use of Occam's Razor, when choosing between equally well supported arguments that do not neglect to consider the available evidence, is an excellent principle to invoke. It is right to simplify, but dangerous to over-simplify.
Advances in Safety and Reliability: ESREL '97 RELATIVE ANNUAL INDIVIDUAL 'RISK'
9
~H I 104-
//fl /
5
lo~-
lO2_ 10-
~
ORTHODOX
.....
W I T H 'BIAS' EVALUATION
PSA
1 o
I IOO,OOO
i 500,000
r YEARS AFTER CLOSURE
Figure 4. Effect of modelling assumptions on risk estimates. For example, the Dry Run 3 trial assessment, see for instance Thompson and Sagar (1993), showed that the then conventional tendency to omit quantitative consideration of the implications of sequences of long-term future climatic changes could lead to a serious underestimate in risk. Such effects may not be significant for other sites, but should evidently be considered fully in any viable safety case. In the present study, Figure 3 shows that an orthodox two-dimensional steady-state analysis gave no indication of high estimated risks to a group situated above the repository (compare curves A and B) nor of the strong spatial variation of exposure to a drinking water recipient (compare curves B, C and D).
The interpretation of existing regulations "Risk" is capable of many interpretations currently and, for instance, may be related to the probability distribution of health detriment in a manner analogous to that used for industrial safety, where curves of frequency versus consequence are often employed to guide decision making. The entire distribution can be compared to particular expressions of aversion to larger consequences using, for convenience, the complementary cumulative probability distribution (CCDF) of conditional risk (yH), as illustrated in Figure 5. Using logarithmic scales, a number of envelopes are shown that might represent different attitudes to risk. Curve A expresses a stakeholder opinion that the 104 p.a. target should always be met, whilst curve B only requires 10-4 p.a. never be exceeded. Curves C1, C2 and C3 retain a conviction that values below the target are of no concern, but these sloping lines represent an increasing degree of aversion to incurring larger risks above that target. Such curves can be derived from or related to personal loss functions. As long as the estimated CCDF lies to the left of the envelope of concern, the particular stakeholders should feel able to accept the safety argument provided that all other conditions, assumptions, judgements etc ... underlying the overall case are also acceptable in their view. The most commonly used interpretation of risk seems to be that based upon arithmetic sample mean dose (H) multiplied by the ICRP risk to dose conversion factor (Y), see Thorne (1988). This interpretation implies equal aversion (or lack of it) to doses on either side of the mean. But this might not be what is desired. It might therefore be appropriate to apply an asymmetric "loss function". One way of doing this would be to estimate risk based on a percentile of doses, Smith (1993). If, for instance, the 95 %ile is considered (Ho.9s) then usually, but not always, higher risks are estimated as in the example shown in Figure 2. Basing the risk upon the simulation run that gives the highest maximum dose (Hm~ yields much larger values, as the figure illustrates. Such a result had been pointed out in 1986, see Thompson and Sagar (1993), to caution against relying upon "worst case" bases for decisions.
10
B.G.J. Thompson and C.R. Williams A, B, C, D, 'ENVELOPES' PROBABILITY OF EXCEEDING
1.00
", AT 3 X 104yEARS - ~ ' ~
\
\c 2
\
...................
0.05
~ ~"C1
3 ........... \ \ \ \ \ \
~-'-- D
\\
\ O.O1 -, '--------7
\ A r
r
-
~
~H
1E-16 1B-14 1E,-12 1B-10 1B-08 1B-06 1E-04 CONDITIONAL ANNUAL INDIVIDUAL 'RISK'
Figure 5. Illustrative results compared with different possible 'risk' envelopes.
When the full consequence distribution is considered, such as required by current US regulations, see for example Anderson et al (1997), then, from Figure 5, it is apparent that, at 360,000 years, the safety case might 'fail' against envelopes A or D, but would 'pass' with respect to B or C. Use of regulatory analyses to review a safety case
Much has been published since the late 1970s concerning the methods and tools used to perform technical analyses ofradiological performance as may be carried out by any single party in the process of decision making in a democratic society. Key concerns, that appear to have received little attention in the literature, are related to the way in which such analyses, undertaken independently by a regulator (or an interest group), are best used to probe the safety case and its underlying arguments in a coherent and traceable manner. Figure 6 illustrates the overall process of assessment by a regulator (activities below the diagonal) of a safety case put forward by a proponent (activities above the diagonal). The first three aspects (a, b, c) of the case are represented, with parallel development by a regulator of s e l e c t e d parts of a similar, but independently conducted, technical analysis. As explained more fully in Sumerling and Read (1994), for instance, it is the sole responsibility of the proponent to produce a full safety case, and a comprehensive set of quantitative results would not be produced by the regulator. Hence, the decision logic would be detailed only for those regulatory activities carried out. Either player would be likely to follow an iterative procedure of technical analysis similar to that shown in Thompson (1994) for instance, which leads to an orthodox PSA result. Dose percentiles versus time might be compared as shown for (say) a particular sub-set ofradionuclides, and a key exposure pathway. Such results, obtained independently, may disagree significantly because conventional analyses are based upon conceptual and computational models that necessarily have systematic biases due to lack of knowledge of system structure and of process representations. Bias is also likely due to numerical approximations and the unavailability of quality assured software that incorporates the latest understanding. The hypothesis is that if such "bias evaluation", as described above for the second phase of the present project, was applied in a c o n s i s t e n t m a n n e r to both sets of orthodox PSA results, it could bring these closer together, as sketched in Figure 6. A corresponding traceable record of the further decisions that are involved would also be examined, Thompson, Gralewski and Grindrod (1995). The process of regulatory review of the three aspects would then lead to the technical information upon which decisions would, in part, be made. If the overall programme of site investigation and other studies is still incomplete, as in Stage 2 described earlier, the DERA case may contain also a strategy (d) to reduce ignorance and to clarify key uncertainties thereby ensuring adequate overall confidence in the final (FERA) arguments. Such a strategy would be expected to reduce the amount of bias to be evaluated in this later safety case.
Advances in Safety and Reliability: ESREL '97
11
ACT IVIT Y BY PROPONE NT \
KNOWLEDGE BASE
N
(cO
I
~t~
I__ COMPREHENSIVE
~11 DEt~SIt~ILOGIC
~i'~,..._n.n.:.:,
n
,t
......
O etc...
.==I
® uJ
r~ >~n >-
DECISION LOGICOF SELECTED ASPECTS
/ RISK
% ILES
/
/
/
TARGET
T IME
"REG. VIEW O~SELECTED AS P ECTS'~: (c)~..~
Figure 6. Illustration of the process of safety case assessment. Preparation for the formal regulatory review
Possible advantages for both parties (i.e. developer and regulator)could occur if a number of issues were resolved before the formal submission of DERA (that is information (a) and safety case (b, c and d)). Hence, agreement might be sought on: a given format of recording and articulating the decision logic, and how to access this through related computer -based facilities; a given format of site geological and related information as, for instance, in the use of common three-dimensional data structures, and in related documents; overall safety case document structure and content; QA arrangements for software development and use, and for gathering and interpreting site data; a compatible treatment of bias to enable the parties involved to at least attempt reconciliation of lines of argument and results; formal agreements about incontrovertible common aspects such as: thermo-chemical data; climate analogue sites and data; the waste inventory and its stable element chemistry, with uncertainties made explicit;
12
B.G.J. Thompson and C.R. Williams terminology, units and symbols; assumptions about the characteristics of future possible exposed groups; interpretation of'risk'; 'best practical means'...., in conjunction with policy groups; protocols for elicitation of subjective judgements and for peer reviews and, finally what might reasonably be expected in terms of 'validation'.
CONCLUDING REMARKS Interaction between regulators and proponents is necessary in advance Of any formal safety submission as well as in direct response to the latter as part of any authorisation process. If the preparation is done carefully there should be "no surprises" in the case presented. At most it should be a refinement of information already delivered, of arguments and decision logic already rehearsed. Software tools and techniques, whose development has been undertaken to well-established software engineering practice and quality assurance, should already have been published. Similarly, all methods underpinning the quantitative arguments and results, revealed in their definitive form in the case itself, should have been reviewed in the scientific and technical literature, Royal Society (1994). The examination of the safety case itself can be regarded as the review of the four aspects identified in this paper, and this examination may be done using nominally four different levels of regulatory and technical capability ranging through a classical peer review to a capability to carry out also any selected part of such a safety analysis in quantitative terms using independently developed tools and methods of analysis. It is suggested here that maintaining this capability keeps open the widest range of opportunities at each of the stages in the assessment process, thereby indicating it to be of most potential benefit to a regulatory body. The entire process is complex, and for its success will depend upon good management based upon relevant "hands on" experience. Management and organisational issues are discussed in the companion paper at this conference by Thompson and Sumerling (1997). Uncertainty is inescapable, and must be openly and thoroughly examined in any credible case. Contrary to much wish~l thinking in this subject it is by no means guaranteed that acquiring and using more site-specific and other data in an analysis will reduce uncertainty. It will, however, enable a better understanding of the domain of uncertainty, and hence reduce ignorance. However it remains, at present, an open question as to the amount of information required to provide regulatory confidence in a safety submission. ACKNOWLEDGEMENTS The authors thank the Environment Agency for permission to publish this paper. The results of this work may be used in the formulation of policy but at this stage do not constitute UK Government policy. The authors are especially appreciative of the constructive comments from Mr R.E. Smith of the Environment Agency during preparation of this paper. REFERENCES
Anderson, D.R., Helton, J.C., Jow, M-N, Marietta, M.G., Chu, M.S.Y. and Basabilvago, G. (1997). Conceptual Computational Structure of the 1996 Performance Assessment for the Waste Isolation Pilot Plant (ibid). Ashworth, A.B. and Porter, I.T. (1996). Application of PSA in the Regulation of the Drigg Low-level Waste Disposal Site. Proc. Third International Conference on Probabilistic Safety Assessment and Management, PSAM III, Crete, (June 1996). Bonano, E.J. and Thompson, B.G.J. (1993), (eds). Probabilistic Risk Assessment on Radioactive Waste, Special Issue of Reliability Engineering and System Safety, vol. 42, nos. 2, 3 (1993).
Advances in Safety and Reliability: ESREL '97
13
Environment Agency, Scottish Environment Pollution Agency, Department of the Environment for Northern Ireland (1997). Radioactive Substances Act 1993: Disposal Facilities on Land for Low and Intermediate Level Radioactive Wastes: Guidance on Requirements for Authorisation. (January 1997). Grindrod, P. (1996). Traceability of Argument and the Treatment of Conceptual and Parametric Uncertainties within a Safety Case, and how the Regulator may examine this by Independent Analysis. PSAM III, Crete, (June 1996). HM Government (1993). Radioactive Substances Act 1993, HMSO, ISBN 0-10-541293-7. ICRP (1985). Radiation Protection Principles for the Disposal of Solid Radioactive Wastes, Annals of the Intl. Commission for Rad. Prot. 15(4), ICRP Publication 46, (1985). Royal Society (1994). Disposal of Radioactive Wastes in Deep Repositories. The Royal Society (London) ISBN 0 85403 493 5, (Nov 1994). Smith, A.F.M. (1993). An Overview of Probabilistic and Statistical Issues in Quantitative Risk Analysis for Radioactive Waste Disposal, Parts 1 and 2, UK Govt., Dept. of Environment Reports, DoE/RR/90. 073 -93 .074 (Jan 1993). Stearn, S.(1994). Risk Analysis in Regulation and Risk Communication. PSAMII, San Diego, Calif. (March 1994). Sumerling, T.J. and Read, D.(1994). Aspects of Review of a Proponent's Post-Closure Safety Assessment on behalf of a Regulator. PSAMII, San Diego, Calif (March 1994). Thompson, B.G.J.(1994). The HMIP Research and Development Programme for Post-Closure Risk Assessment. Proc. Second Intl. Conf. on Prob. Safety Assessment and Management, PSAMII, San Diego, Calif., USA (March 1994). Thompson, B.G.J., Gralewski, Z.A. and Grindrod, P. (1995). On the Estimation of Bias in Post-Closure Performance Assessment of Underground Radioactive Waste Disposal, Proc. 4th. Intl. High Level Rad. Waste Man. Conf., Las Vegas, Nev., USA. (April 1995). Thompson, B.G.J. and Sagar, B. (1993). The development and application of integrated procedures for postclosure assessment, based upon Monte Carlo simulation: the probabilistic systems assessment (PSA) approach. Rel. Eng. and Syst. Safety, vo142, pp 125-160 (1993). Thompson, B.J.G., Smith, R.E. and Porter, I.T. (1996). Some Issues affecting the Regulatory Assessment of Long-Term Post-Closure Risks from Underground Disposal of Radioactive Wastes. Proc. Third International Conference on Probabilistic Safety Assessment and Management, PSAM III, Crete, (June 1996). Thompson, B.G.J. and Sumerling, T.J. (1997). Organisational and Management Issues in the Regulatory Assessment of Underground Radioactive Waste Disposal (ibid). Thorne, M.C. (1998). Assessment of the Radiological Risks of Underground Disposal of Solid Radioactive Wastes, IrK Govt, Dept Of Environment Report No. DoE/RW/89.030 (Dec 1988).
This Page Intentionally Left Blank
DEVELOPMENTS AND PRACTICE TOWARDS RISK BASED REGULATIONS IN VARIOUS TECHNOLOGIES H.P. Berg ~and P. Kafka 2 Bundesamt ~ r Strahlenschutz (BfS) P. O. Box 10 01 49, D-38201 Salzgitter, FRG. 2 Gesellschaft for Anlagen- und Reaktorsicherheit (GRS) mbH Forschungsgel~inde, D-85748 Garching, FRG.
ABSTRACT Over a long period of time, systems design and structure functions have been developed and estimated by the so-called trial-and-error method. With the increasing importance of complex and large-scale technologies functional and safety problems initiated by random effects within the man-machine-milieu interaction have challenged new procedures. Safety engineering and the relevant regulations turned from a retrospective to a prospective procedure. For this prospective procedure the so-called deterministic approach based on deterministic criteria and conservative calculations was established first. Today exists an increasing utilization of the so-called probabilistic approach to take into account risk aspects to a larger extent. The paper illuminates some basics in safety engineering, discusses some pros and cons regarding the deterministic and probabilistic approach and shows recent developments and practices towards risk based regulations in various technologies. Specific examples will be given from Civil Engineering, Space and Aviation Industry, the practice for Marine Structures and in the Process Industry. In the case of Nuclear Technology will be shown in particular current trends to support operational and maintenance decisions during plant operation not only by performance based but also by risk based considerations. The unresolved issue for many legal environments in various countries namely the uncertainties of probabilistic results and the vagueness of the state of knowledge, will be explained. Finally, some recommendations for supporting actions towards risk based regulations will be given. KEYWORDS: Safety Engineering, Risk Based Regulations, Risk Informed Regulations, Probabilistic Safety Assessment, Probabilistic Approach.
HISTORICAL PERSPECTIVE More than 2,400 years ago Pericles stated that: "the worst thing is to rush into actions before the consequences have been properly debated", and "the Athenians are capable at the same time of taking Risk and Estimating them before-hand". Realizing that already the ancient Athenians knew this codex, it is really surprising that today Safety Engineers have to learn again how all the various players in the real world have to be convinced that a modem society should move towards principles known to the Athenians. 15
16
H.P. Berg and P. Kafka
As traditionally teached at the universities, an engineer has to design a component, system or structure in such a way that the product must function and be safe. A building, e.g., must possess a structure which provides strength and stiffness so that the entire system can perform the duties for which it was specified. Over a long period of time, systems design and structure functions have been developed by the so-called trial-and-error method. That means, based on the lessons learned from undesired events, e. g. the safety factors and the codes of engineering practice were improved step by step, expecting that new design would continue to meet the function and be more safe. With the increasing importance of complex and large-scale technologies functional and safety problems initiated by random effects within the man-machine-milieu interaction have challenged new procedures, e.g. to estimate analytically the prospective behavior of the component, system or structure. Safety engineering turned from a retrospective to a prospective procedure (see also: Blockley (1992), Fragola (1996), Kafka (1996 B, 1996 C)).
SYSTEM DESIGN VERSUS SYSTEM ASSESSMENT In principle, there is fundamental distinction between a task to design and construct a new system or to assess an existing one. In the first case, the state of knowledge regarding the layout and the foreseen function of the system is restricted. However, rules, design codes and recommendations for a proper and safe design are normally available and can be used in a mix for the creation of the various specifications and the calculation of the design parameters. The designer concentrates on the realization of the "function" of the system and the computation of the relevant point values for it. The required reliability is mainly ensured by conservative safety factors. In the second case, the state of knowledge regarding the system layout is more satisfying and most of the parameters are measurables of the system and operational experience is available. To assess "function" and "malfunctions" of components and the resulting consequences for the system are the duties. Other methods and tools are needed, e. g., event trees, fault trees and uncertainty simulations. An assessment of the safety level therefore requires an integrative respective "umbrella" procedure. Such a procedure allows to evaluate all consequences, effects and safety contributions of the system characteristics realized as a manifestation of the utilization of various rules, standards and requirements. If only the compliance with all these rules and recommendations and the correctness of the calculated design parameters are checked point by point separately, no integrative answer regarding the entire safety level can be given. The picture is complete only if the puzzle pieces are integrated together. In simple words: the design of a safe new system is a forward chaining task and to assess the safety level of an operating system is a backward chaining task, each performed normally with specifically adopted methods and tools. A design procedure graphically follows an event tree structure dealing with the task of establishing all the end states (design parameters) originating from the expected system function. Vice versa, an assessment procedure graphically follows a fault tree structure dealing with the task to identify all the possible root states (causes) for the malfunction of the system. This distinction is one of the reason why an applicant (the designer) and an assessor (the regulator) are often involved in long discussions regarding the most appropriate methods and tools needed for the common aim, the realization of a safe system.
DETERMINISTIC VERSUS PROBABILISTIC APPROACH
A deterministic criterion can be characterized as a pre-defined design rule whose fulfillment provides sufficient confidence that the design intent is met. These rules are based and established on the experience and expertise of a rule-making body, normally composed by members coming from different groups of interest e. g. designers, operators, and regulators. Such rules can be qualitative, quantitative or a mix of both (see Kafka (1995), Thadani (1996)).
Advances in Safety and Reliability: ESREL '97
17
The essence of such a type of approach is that a deterministic analysis or calculation has to be performed and one has to show compliance with rules in a "checklist format" based on y e s and n o answers. The deterministic analysis can be characterized as a point value calculation via a functional representation of the system behavior including so-called conservative assumptions. Thus, the deterministic analysis is a single snapshot into the space of all the possibilities which can be formed by the real world behavior. One has to be aware that this simplification implicitly means that all the other possibilities - not considered by this snapshot - are excluded (some say as misuse: other cases are not possible). The strength of the deterministic approach is that the associated analysis and decision making process is relatively clear and simple. The systems analysis and the associated calculations are straightforward and the decision making answer is "Go" or "No-Go". The weakness of this approach is the extensive use of expert judgment without any explicit consideration of various types of uncertainties and the lack of any information about which criteria or analysis results are more or less important with respect to the safety level. A ranking procedure regarding issues or outcomes is not possible. Additionally, the world can not be modeled realistically using conservative assumptions. The real world normally follows the most probable circumstances and boundary conditions. In other words, an accident scenario simulated with conservative parameters represents a very rare single case within the space of all the possibilities. Finally, the deterministic approach may give the false impression that the results are "certain" and the scenarios are "true". A probabilistic approach can be characterized by an extensive use of probabilities. This implies also the extensive searching process for failure "possibilities" in systems" analysis and the performance of quantitative calculations because of the existence of random processes in the real world. In other words, the approach searches for the spectrum of possibilities quantified with probabilities. Thus, the analyst has a more comprehensive rather then a snapshot (by the way of a deterministic approach) view to the real world. Evidently probabilistic criteria are normally expressed in terms of failure or success probabilities per demand. The strengths are the integrative and quantitative approach which allows rankings of issues and results, explicit consideration and treatment of all types of uncertainties, and application of an optimization process Apostolakis (1990). A (fictitious) weakness of the probabilistic approach is the more complex and time consuming analysis and decision making process because more information and insights have to be collected, processed and considered for decisions. A still unresolved issue for many legal environments in various countries is the fact that the probabilistic approach explicitly shows the uncertainties and the vagueness of the state of knowledge and the result has to be characterized as a prognostic estimation of what in future can happen or not. In particular, the problem of incompleteness and sensitivity of the results is addressed. However, although also the probabilistic approach is only a model of the real world it represents the real world in a much more realistic way.
THE ELEMENTS OF RISK
The extent and nature of most safety engineering problems are such that a suit of technologies operating as an integrated safety feature would be required to prevent and mitigate existing potential hazards. Thus, the design, evaluation and assessment of the safety technologies is a complex decision process that is affected by a wide range of factors. Selecting technologies to work as an integrated safety feature is an optimization process. For each technology the objective is to maximize the positive impact and to minimize the negative ones. There exists a wide-spread consensus that optimization processes need a complete model focusing on all quantifiable issues of interest. A risk model as the foundation for formal safety optimizations and decisions is widely
18
H.R Berg and R Kafka
accepted as the preferred vehicle for an explicit and systematic consideration of all the issues affecting decision making in safety engineering (see also: Ale (1996), Aven (1996), Bonano (1996), E.C. (1993), Hessel (1996), Hirschberg (1996), Schmidt (1996), Watson (1993)). Ongoing findings and recommendations, e .g., by the Center for Risk Analysis at the Harvard School of Public Health, prepared for the U.S. Congress, CRA (1995), and the National Research Council (NRC) of the U. S. National Academy of Science, Bonano (1996), have both strongly advocated the use of risk assessment in environmental management and other decision making processes. It can be assumed that there also exists a consensus that safety engineering of complex installations is very much interrelated with environmental aspects. Important elements of "risk" in the context of the usefulness for safety engineering are the identified spectrum of undesired events, the estimated frequencies and consequences of these events, and the identified and quantified spectrum of the various types of uncertainties.
AIMS, GOALS AND TARGETS Safety Engineering is in principle a management process to establish aims, goals and targets, to transfer these requirements into the design and construction of the real system, and to assess the realized system with respect to the compliance with the established aims, goals and targets. It is usually said that system "aims" are the general aspects mainly focusing on the envisaged function and duties of the system. Goals are mostly used in the context of "Safety Goals", i.e. qualitative or quantitative requirements with respect to safety for the entire system. U.S. NRC (1986). "Targets" are mainly used in connection with system functions expressed in reliability and/or availability characteristics. Petersen (1992). ,
Level 4 Environment Level 3
Plant
TOPGoal J
Risk -Based
i¢ ~ ¢
~o~,~,~~,,,~,~~,,
n~.
C. . . . . . . . . . :.I..... ~.~ /. ~,~j~1~ ~ V ~,
Specific
Level 2 System
Level 1 Component (deterministic and/or probabilistic)
Fig. 1: Breakdown of Targets based on a Top Goal. Kafka (1995). All these expressions can, in principle be mapped into the various levels of the system (top level, subsystem level, component level or piece part level). To establish, e. g., targets on different system levels, a top-down procedure should be used (see Fig.l). Starting with a safety goal on the top of this pyramid one can break down targets at the various system levels. In Reliability Engineering appropriate tools exist to execute this breakdown in a structured manner. The safety goal set at the top of the system is correlated to the question "how safe is safe enough".
Advances in Safety and Reliability: ESREL '97
19
Nowadays there exists a preference to establish this goal quantitatively, i.e., expressed by specific risk components (for example expressed as a frequency of occurrence of a given event scenario per plant-year). A pragmatic approach to establish such a safety goal is used in various technologies (Aviation, Haak (1995), Shooman (1990), JAA (1989), Space, Preyssl (1995), Klein (1996), Nuclear, Thadani (1996), OffShore, DNV (1992). Knowing and considering the "realized standard" for the existing installations the goal for "new" installations should e.g. two orders of magnitude (factor 100) "safer" (of lower in risk) than the existing installations. In other words, the frequency of a predefined catastrophic failure has to be less than 10x per installation-year. With the help of such a pragmatic approach one can perform the breakdown. Besides such a breakdown procedure there exists in most technologies a set of well established rules and regulations (based on best engineering practice) to achieve in a pragmatic way "safe" systems. Examples are the so-called single failure criterion, the spatial separation or the defense in depth concept. These rules should also be considered in safety engineering to gain a high safety standard. It should be mentioned that the issue "how safe is safe enough" would have a very strong relation and dimension to the risk awareness, acceptance and tolerability by the public. In the context of this paper comments and discussions on that topic are not foreseen. WHAT IS GOING ON IN VARIOUS TECHNOLOGIES NOWADAYS Safety Engineering regarding large technological systems, which essentially are assembled of active components (pumps, valves), passive structures (pipes, vessels), and the operational staff managing operation and maintenance requires a risk based analysis process. This process involves four main issues: (1) component reliability, (2)structural reliability (3) man-machine reliability, and (4) an integrative system reliability model. These issues and the necessary methods are more or less available and used in all technologies. Many more differences are in the various regulatory environments regarding the requirements of which type of studies and assessments are appropriate and needed. It varies from the opinion that a risk based (probabilistic) approach is not adequate, (e.g. Germany, chemical industry) toward to a totally risk based regulatory environment (e.g. Holland, process industry, Ale (1996)). By way of other examples, the aviation industry (e.g. Airbus industry, Haak (1995)) has used a probabilistic design concept for a few years, including a safety goal for catastrophic accidents and reliability targets for systems and components. The space industry moves more and more to a risk based approach for the main project decisions and to reliability targets for systems and components. Large manufacturing industries (e.g. Toyota, Ford Motor Company) moves toward Reliability and Maintainability (R & M) targets for all equipments and production lines, Reichart (1994), SAE (1995). In the civil and marine structure industries there exist probabilistic design codes for the design of structures including a set of probabilistic goals and pre-formulated calculation procedures. DNV (1992). In the nuclear industry one can observe worldwide in the last years a movement toward risk based approach and regulations which is strongly encouraged from the industry. Probabilistic Safety Assessment (PSA) has become the tool of choice for selecting the best of several alternatives. Closely related to risk based regulation is the development of performance based rules. Such rules focus on the final result to be achieved. They do not specify the process, but instead establish the goals to be reached and the procedures how the achievement of those goals is to be judged. The inspection and enforcement activities are based on whether or not the goals have been met. Risk based regulation has the potential of both improving nuclear power plant safety and reducing plant operating costs. This modern form of regulation could be applied to present operating installations and to advanced designs. In fact, it would help to quantify the safety improvements of advanced designs. The application of PSA technology to the regulatory process can reduce public risks in several ways: by finding design weaknesses, by improving plant operations, and in developing severe accident management programs. For example, a traditional product of a Level 1 PSA is some estimate of the likelihood of a
20
H.E Berg and E Kafka
nuclear power plant having a core damage or core melt event. The overall core melt frequency is estimated by summing up many thousands of accident sequences, each providing some increment of core melt frequency. If a Level 2 PSA is performed, then there will also be estimates of the containment failure frequency and the releases of radioactive material to the environment associated with each containment failure mode. A large sum, e.g., a high core melt frequency or high containment failure frequency, can be an indication of a poor design. Further, by examining the different contributors to the aggregate value, particular areas of design weakness can be pin-pointed. Therefore, PSA results can be used to evaluate the design of nuclear power plants. Numerous plant-specific design improvements have already been implemented in various nuclear plants based on PSA insights, thereby lowering nuclear risks. Garrick (1995). More recently, PSA techniques have been applied in evaluating the operation of nuclear power plants focusing the interest on how plant risks vary with time. Kafka (1996 A). There are several mechanisms that can cause plant risks to change over time. The performance of individual components and whole systems may degrade due to aging or improve due to design modification or enhanced maintenance. Plant configurations also change from time-to-time as certain components are removed from (or restored to) service for tests and/or maintenance, while others may be removed through failure. Configurations also change when going from one plant operating mode to another, such as transition from power operation to shutdown. Since the risk significance of a component or system is also a function of the plant's configuration, changing configurations yield different risk levels. Just as earlier applications of integral PSA results were utilized to reduce the risks due to design weaknesses, present specific PSA applications are increasingly dedicated to minimizing operational weaknesses, e.g., avoiding high risk plant configurations. Quantitative safety criteria and objectives - correlated with the risk of each single individual in the vicinity of the plant and/or the societal risk of the population as a whole - are used in the decision-making process, for example, in the United Kingdom, Cassidy (1996), and in the Netherlands, Ale (1996). In both countries, this safety concept is not restricted to nuclear installations but it has been adopted as a more global safety policy regarding all potential hazardous industries and activities. Another significant milestone in the development of risk based regulation in the United States was the development of quantitative safety goals and there endorsement in a Nuclear Regulatory Commission (NRC) Policy Statement in 1986; U.S. NRC (1986). This addresses the question of "how safe is safe enough?". In the years following the safety goal policy statement, the relationship between specific regulatory requirements and the risk reduction or lack of it have been investigated in a number of intemal NRC studies. In 1994 the Commission approved a Probabilistic Risk Assessment (PRA) implementation plan. The plan addresses the use of PRA in all major NRC functions, reactor regulation, research, evaluation of operational date, utilization of nuclear materials, and waste disposal. Its major elements include developing decision criteria for regulatory applications of PRA, developing pilot projects to test PRA application in specific circumstances, looking at the contribution of risk based thinking to the inspection process, and examining operator licensing issues from risk perspective. Following the PRA implementation plan was the publication of the Commission's PRA Policy Statement in 1995; U.S. NRC (1995). The PRA policy statement formalizes the Commission's commitment to risk informed regulation. It states, in part, "The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data, and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense in depth philosophy". Nowadays there exists a minor distinction between "risk based" and "risk informed" regulation and the Commission has begun to substitutes the.clearer term risk informed for risk based in its lexicon. Murphy (1995), Garrick (1995). The main elements of the implementation plan are threefold. The first part defines the regulatory areas where PRA can play a role in the decision making process. The second part underlines that the current deterministic engineering approach is maintained unless a solid basis for change is established. The third part of the framework are probabilistic considerations. Key elements are the use of established methods, success
Advances in Safety and Reliability: ESREL '97
21
criteria, human and equipment reliability data and sensitivity and uncertainty analysis. The final part is the integration of deterministic and probabilistic considerations. The success of risk informed regulations ultimately depends on having sufficient reliability data to allow quantification of regulatory alternatives in terms of relative risk contribution. The NRC is considering in this context a new rule which is submitted for public comments, which would require power reactor licensees to collect and report to the NRC certain equipment reliability data. Also the so-called "Maintenance Rule" represents a step towards risk informed regulations. U. S. NRC (1996). In the Federal Republic of Germany, the nuclear licensing procedure is essentially based on deterministic safety analysis. In the context of periodic safety reviews which are recommended for all nuclear power plants in operation, also probabilistic considerations can be taken into account; this is a first smoothly step towards the international activities, but PSA, at present, only supports but does not determine regulatory decision making. Berg (1996A). As desirable as it might be to write regulations in terms of the ultimate measure of probabilities, it is not even nearly possible to define the probability of a possible accident sequence with enough precision and enough replicability to use such probabilities as terms in the regulations bottom line. Therefore the uncertainties have to be considered additionally. The fact that the PSA does not model all relevant issues (problem of incompleteness) and that the results are not sufficiently robust (problem of sensitiveness) is the main reason why PSA could not be the sole tool or basis for creating a new regulatory regime in the near future. Therefore, the determination of probabilistic safety goals is not supported in Germany from the legal point of view, neither as probabilistic limits nor as orientation values. In contrast, for the design of advanced reactor types like the European Pressurized Water Reactor (EPR) the common recommendations of the German and French advising bodies for the regulators have made an interesting statement: "For determining the adequate combination of redundancy and diversity in safety systems, the designer may use probabilistic targets as orientation values; in that case, orientation values of 10 -6 per year for the core damage probability due to internal events for power states and for shutdown states, respectively, could be used, having in mind the necessity to consider associated uncertainties. For those internal and external hazards the probabilities of which cannot be realistically determined, provisions have to be implemented by the designer to obtain a consistent design; this is the case for earthquakes, for which the designer has to state, in which way he intends to prove the existence of sufficient design margins". RSK (1994). In some other countries utilizing nuclear energy, e. g. Finland, Canada, Sweden, Switzerland, there is an increasing trend toward establishment and use of risk based regulations intermeshed with quantitative probabilistic safety goals. The current status and practice is shown, e. g., in Berg (1996A), SKi (1996). When properly applied, the results of a PSA can be used to identify and prioritize the importance of hardware, human actions (operation and maintenance staff activities) and plant procedures to plant risk. The information contained in a PSA is also important in the development of a sound risk management program that could be used for decision-making purposes. An integral part of a comprehensive risk management program at a nuclear power plant would be a living PSA that could be used as the basis for day-to-day operational and maintenance activities and for the short and long-term assessment and prioritization of safety-related needs. Regarding risk management, the idea of such a living PSA has been supported in the framework of the German Nuclear Regulatory Research Program.
22
H.E Berg and P. Katka
PROS AND CONS OF RISK BASED A P P R O A C H AND REGULATIONS Although some countries and various technologies are strongly discussing a proposed transition process from deterministic to a risk based approach the pros and cons including challenges of such a transition process should be taken into account. Summarizing the pros of the risk based approach considering its essential potential and the long term ideas and goals one can conclude: • it is supported explicitly (quantitatively) by our historical experience, • it is based on the understanding of the system and component behavior formulated in deterministic codes and calculations, • it the real world with all the determined, random and uncertain elements and parameters based on our state of knowledge, • it is quantitative and therefore appropriate for sensitivity, importance and optimization studies, • it integrates design, manufacturing and operational aspects for safety balancing over the life cycle of the system, • it integrates all the safety issues and allows therefore rankings and optimizations. Specific benefits of risk based regulations are: • • • • •
to to to to to
have a cost-effective approach to regulation, assure that resources are focused on essential safety issues, have a methodology that can be used to both enhance safety and manage operability, be able to communicate results and decisions on a clearly defined basis, attain an open, fair, and predictable regulatory framework.
On the other hand, there are disadvantages and difficulties which are posed by such a risk based approach: • to place very heavy reliance upon the exercise of regulatory personnel in judging whether standards have been complied with, whether risks have been properly identified and quantified, and whether enough preventive or mitigative measures have been taken to satisfy the proper balancing of costs and risks, • to ensure that the regulator's forces are extremely well-informed scientifically and technologically in order to produce consistent application of standards, • to be relatively time-consuming in ensuring a sound data-base for decisions about risk and methods of control in assessing safety, • to impart a high degree of uncertainty into computations of whether risks have been reduced in a sufficient manner which might be a fertile ground for endless debate between utility and regulator. Challenges which are associated with developing and implementing risk based approaches to regulation are: • to obtain an acceptable methodology for risk assessments that is commensurate with the decisions to be made, • to perform the needed, relevant risk assessments, • to focus regulatory questions so that risk assessments can be useful, • to have a regulatory structure that encourages risk based methods, • to perform the necessary regulatory research that assures a robust, stable approach to risk based regulation, • to effectively communicate the process, risks, and decisions to the public.
Advances in Safety and Reliability: ESREL '97
23
CONCLUSIONS AND RECOMMENDATIONS A large number of contributions are available regarding the presented topic and only a few of them are referred in this paper. In this resume we will attempt to Summarize important insights and remarks from the widespread developments and applications of risk based approaches in safety engineering. • The suggestive idea for an ecologically and economically beneficial system (i. e. the higher the danger potential of a component, the more reliable the component itself and its safety features must be) can today be found in all safety engineering approaches within the various technological sectors. Nevertheless, the required and/or demonstrated safety level of systems is often evaluated by general engineering judgments, rules and requirements only. • The use of an entire model to build up all the physical and logical interrelations of the important elements and the adoptions of quantitative methods to evaluate this model is neither well established nor balanced in the various technologies. While nuclear technology, space, aviation, off-shore industry and civil engineering is at the front end, chemical engineering is at the back end. Also the status, effort and the application related to the risk based approach is very inhomogeneous in the various countries (e. g. Holland, Ale (1996), Norway, Aven (1996), Switzerland, BUWAL (1991), U. K., SKi (1996), U.S.A., SKi (1996), U. S. Congress (1994), is in the front end, and Germany is at the back end). • The principal value of risk based approach is that it represents the most complete compilation of the state-of-the-art knowledge analysis and data available for a given problem to develop an integrative perspective necessary to assess the variety of relationships between initiating events, human and equipment performance, mitigation features, accident phenomena and, if necessary, health effects and consequences. The risk based approach can also usefully be applied for balancing and evaluating the system design, the manufacturing aspects and the operation including operator actions and maintenance activities. Kafka (1996). • The deterministic approach for designing and assessing the system regarding safety performance generates in this context only limited insights which are needed as basic information but are solely not sufficient for decision making in safety engineering. Rankings and optimizations are requested. All the answers generated by the deterministic approach are uncorrelated with respect to the entire system characteristics. • The significant benefit of the risk based approach i. e. the identification and analysis of the possible event scenarios, generates much more insights than achievable by the deterministic analysis process. • The utilization of risk based approach requires of course more manpower and computation effort than a safety assessment with simplified assumption and based on checklist-formatted rules. But the larger effort must be balanced against the larger benefit in terms of a higher confidence in less risky systems. • The process of the risk based approach shows "uncertainties" and "vague" insights. This "new" situation for lawyers and regulators challenges further development of some basic laws and acts in safety engineering. The deterministic approach holds hidden these uncertainties and vague insights. It pretends an accuracy which is not given in the real world. Based on these summarized statements we want to give the following recommendations: • A risk based approach requires both, risk based procedures - to do safety engineering, and risk based regulations - to control what we have done in safety engineering. Both tools should undergo further developments to improve the state of knowledge for reduction of uncertainties in decision making. • As typical for all engineering fields, although some lessons learned from applications and historical events are beneficially adopted in the risk based approach (e. g. human factor, common cause failures), other issues (e.g. computer/software reliability) must undergo further developments and research work. • Finally, it should be stressed that in high level information processing systems, such as the risk based approach, should be a continuous activity established to collect and model the increasing state of knowledge and to quantify, as best as possible, also the so-called unquantifyable issues (e. g. the
H.R Berg and R Kafka
24
safety culture, managerial aspects) per se. The risk based approach is a living process; there will never be an end to the story.
REFERENCES
Ale, B.J.M., Laheij, G.M.H., Uijt de Haag, P.A.M. "Zoning Instruments for Major Accident Prevention" Proceedings, ESREL" 96 - PSAM III, Crete, 1996, Springer Verlag, pp 2191 - 2196 Center for Risk Analysis, CRA, Harvard "Reform of Risk Regulation: Achieving more Protection at less Cost" Harvard School of Public Health, Boston, USA, March 1995 Apostolakis, G. "The Concept of Probability in Safety Assessment of Technological Systems" Science 50 (1990), pp 1359- 1366 Aven, T., Nja, O., Rettedal, W. "On Risk Acceptance and Risk Interpretation" Proceedings, ESREL'96 PSAM III, Crete, 1996, Springer Verlag, pp 2191 - 2196 H. P. Berg "Approach for Risk Based Regulation and Risk Management of Nuclear Power Plants", Proceedings of SRA Europe Meeting 1996, University of Surry, Guilford, June 1996 (A) Berg, H.P., G6rtz, R., Schaefer, T., Schott, H. "Quantitative probabilistische Sicherheitskriterien ffir Genehmigung und Betrieb kerntechnischer Anlagen: Status und Entwicklung im internationalen Vergleich" BfS-KT-15/96, 1996 (B) Blockley, D, Edt. "Engineering Safety" McGraw-Hill Book Company, 1992 Bonano, E., Peil, K. "Risk Assessment: a Defensible Foundation for Environmental Management Decision Making" Proceedings, ESREL'96- PSAM III, Crete, 1996, Springer Verlag, pp 2117-2121 BUWAL "Handbuch I zur St6rfallverordnung STFV" Bundesamt (Buwal), Schweiz, Juni 1991 Cassidy, K. "UK Risk Criteria for Siting of Hazardous Installations and Development in their Vicinity" Proceedings, ESREL' 96 - PSAM III, Crete, 1996, Springer Verlag, pp 1892 - 1898 DNV "Structural Reliability Analysis of Marine Structures" Classification AS, N-1322 Horvik, June 1992 Fragola, J. "Design Decisions and Risk: Engineering Applications" Proceedings, ESREL'96 - PSAM III, Crete, 1996, Springer Verlag, pp 1811 - 1816 Fragola, J., Shoomann, L. "Experience Bounds on Nuclear Plant Probabilistic Safety Assessment" 92RM-165: Garrick, J., Wakefield, D. "A Progress Report on the Status of Selected Applications of Probabilistic Risk Assessment in the U.S. Nuclear Power Industry" Proceedings, KAERI, PSA'95 November 1995, Seoul, pp 923 - 926 Haak, D. Airbus GmbH, Hamburg, informal communication, 1995 Hessel, P.P. "Toward Risk based Regulation" Proceedings, ESREL'96 - PSAM III, Crete, 1996, Springer Verlag, pp 339-342 Hirschberg, S., Spiekerman, G. "Comparative Evaluation of Severe Accident Risk Associated with Electricity Generation Systems" Proceedings, ESREL'96- PSAM III, Crete, 1996, Springer Verlag, pp 3945
Advances in Safety and Reliability: ESREL '97
25
HSK SKi "Proceedings of Executive Meeting on Risk-Based Regulations and Inspections" Vol I, II, SKi 96-69, 1996 -
International Atomic Energy Agency, IAEA "INSAG- 5, The Safety of Nuclear Power" IAEA Safety Series No. 75-INSAG-5, 1994 Joint Aviation Authority, JAA "Basic Objective Requirements for all Systems on Large Transport Category Airplanes" JAR 25.1309, 1989 Joksimovich, B. "Man versus Machine in Nuclear Safety Regulation" Proceedings, Seoul, Korea 1995, pp 788 - 794
KAERI, PSA'95,
Kafka, P. "Sicherheit grol3technischer Anlagen" TO, VDI Verlag Dtisseldorf, 9/95 September 1995, pp 354 - 357 Kafka P., Gromann A. "Where we are in Living PSA and Risk Monitoring" Proceedings, ESREL'96 PSAM III, Crete, 1996 (A), Springer Verlag, pp 1884 - 1891 Kafka, P. "Probabilistic Safety Assessment: Quantitative Process to Balance Design, Manufacturing and Operation for Safety of Plant Structures and Systems" Nuclear Engineering and Design 165 (1996) pp 33-350, 1996 (B) Kafka P. "Safety Engineering - Why Should we Move Towards Risk-Based Evaluations?" Proceedings, SKi 96-69, Vol 2, 1996 (C) Klein, M., Schueller, G.I., Esnault, P. "Guidelines for Factors of Safety for Aerospace Structures" Proceedings, ESREL'96 - PSAM III, Crete, 1996, Springer Verlag, pp 1696 - 1701 Murphy, J. "Risk Based Regulation: Practical Experience in Using Risk-Related Insights to Solve Regulatory Issues" Proceedings, KAERI, PSA'95 November 1995, Seoul, pp 945 -948 Petersen, K. , Sieger, K., Kongso, H. "Setting Reliability Targets for the Great Belt Link Tunnel Equipment" Paper, ESReDA Seminar, Amsterdam, Holland, April, 1992 Preyssl, Ch. "Safety Risk Assessment and Management - the ESA Approach" Reliability Engineering and System Safety, 49 (1995) pp 303 - 309 Reichart, G., Dilger, E., Winner, H. "Iterative Safety Design Process - Ein Ansatz zur Sicherheitsanalyse und -bewertung ktinftiger Fahrzeugsysteme" VDI Bericht 1152, Dtisseldorf 1994 RSK "Gemeinsame Empfehlung von RSK und GPR f~r Sicherheitsanforderungen an zukiinftige Kernkraftwerke mit Druckwasserreaktor", admitted in 1994 SAE "Reliability and Maintainability Guideline for Manufacturing Machinery and Equipment" Society of Automotive Engineers, Inc., SAE, Warrendale, PA, USA, 1995 Schmidt, S. "Decision Analysis, Risk Research & Assessment: An Integrated Approach for Risk Management" Proceedings, ESREL'96 - PSAM III, Crete, 1996, Springer Verlag, pp 1817 - 1822 Shooman, M. "Probabilistic Reliability: An Engineering Approach" 2nd Edition, Kreiger, Melbourne, FL, 1990 Thadani, A., Murphy, J. "Risk-Informed Regulation - Issues and Prospects for its Use in Reactor Regulation in den USA" Proceedings, ESREL'96 - PSAM III, Crete, 1996, Springer Verlag, pp 2172 2177
26
H.P. Berg and P. Kafka
The Engineering Council (E. C.) "Guidelines on Risk Issues" The Engineering Council, U. K., 1993, ISBN 0-9516611-7-5 U.S. Congress "Risk Assessment Improvement Act of 1994" Identifier: H. R. 4306, USA, 1994 U.S. NRC "Safety Goals for Nuclear Power Plant Operation" U.S. NRC, Washington DC, NUREG-0880, 1986 U. S. NRC "Probabilistic Risk Assessment Implementation Plan", U.S. NRC, Washington DC, 1994 U.S. NRC "PRA Policy Statement", U. S. NRC, Washington DC, 1995 U. S. NRC "Maintenance Rule", 10 CFR 50.65, U. S. NRC, Washington DC, 10 July 1996 Watson, I. "Developments in Risk Management" Paper, ESREL'93, Munich, VDI Verlag DOsseldorf, 1993, pp 511-521
INCORPORATI NG RISK ASSESSMENT AND ITS RESULTS IN THE DECISION-MAKING PROCESS J M Le Guen Health and Safety Executive, Rose Court, 2 Southwark Bridge, London SE 1 7HS, UK
ABSTRACT The degree to which risks should be controlled is essentially a question of values. Individuals tolerate different levels of risk depending on the benefits they think they will gain from taking the risks. Equally, society's tolerance of different risks varies dramatically for a whole variety of reasons, some relatively straightforward and amenable to scientific evaluation and others complex expressions of deep-seated, psychological attitudes. This paper sets out criteria which HSE has developed against that background for defining tolerable levels of risks and integrating that in the decision-making process. The criteria accept that risk assessment, more often than not, cannot produce scientific estimates of actual risks but can instead only produce conditional estimates of risks under specified sets of assumptions; that there is generally a need to achieve a balance between risks and costs but equally that there are some risks that cannot be tolerated under any circumstances. The criteria have gained considerable acceptance within industry. It has helped HSE to meet its objective of being an open and transparent organisation by showing how decisions about risks are arrived at, and by letting duty holders understand what is expected of them and what they should expect from the regulator. KEYWORDS Unacceptable risk, tolerable risk, negligible risk, criteria for standard setting. INTRODUCTION As we approach the Millennium, contrasting public attitudes to a technological society at the beginning and at the turn of the twentieth century, is most revealing. In 1900, 'la belle ~poque', there was considerable optimism that science and technology would solve everything, transform people lives and make the world a safer, healthier and more prosperous one to live in. A lot of this has happened. During the last hundred years the standard of living has risen dramatically; we now live longer and are generally healthier. Yet people have never been more pre-occupied with risks to health, safety and the environment. Even more disturbingly, there is today a general malaise about science and technology. There are several reasons for this phenomenon. I will mention only a few. Firstly, the majority of people in industrialised countries these days no longer have to struggle for their daily bread. In industrialised countries obesity is now a bigger problem than malnutrition. As a result the acceptance of industrialisation to gain increased standards of living is no longer as readily given as when the fight against hunger and poverty overshadowed everything. This is giving rise to a growing propensity to scrutinise benefits brought about by industrialisation against its undesirable side effects such as the risk of being maimed or killed or environmental pollution. 27
28
J.M. Le Guen
Secondly, there is a perception that the exploitation of modern technology is increasingly giving rise to risks: which could lead to catastrophic consequences - perceptions fuelled by greater awareness of issues such as nuclear fall-out following Chernobyl, depletion of the ozone layer, global warming and acid rain; where the consequences may be irreversible, eg. the release of genetically modified organisms; which lead to inequalities because they affect some people more than others such as those arising from the siting of a chemical plant, power station or a waste disposal facility; which could pose a threat to future generations such as radioactive waste depositories. Thirdly, whereas nearly everyone can readily assess the threat of a tiger over one's shoulder, this is not the case for risks posed by many of the newer hazards arising from industrialisation, eg pollutants in foodstuff. People must rely instead on the opinion of experts. However, the trust placed in expert opinion as a source of reassurance is being continually eroded particularly for those issues where the mass media have exposed controversies surrounding such opinions. There is a school of thought emerging that society's concerns about risks have now reached such a point that the redistribution of risks in society is becoming as important politically as the re-distribution of wealth (though the political system may be still lagging behind and may still be predominantly concerned with the latter). Whether this is true or not is still a matter for debate, but what cannot be denied is that: -
many managers today have less freedom in management matters which only yesterday they would have regarded as a private matter for themselves to decide; eg plans for modifying their plant within their own boundaries, what raw materials and processes they should use, or how the waste generated (or the plant itself at the end of its useful life) should be disposed of; more and more restrictions are being placed at international or European level on goods and services that are allowed on the market because of the risks (real or perceived) that they entail; ignoring or riding rough-shod over society's concerns may cause markets to collapse, give rise to calls for bureaucratic checks and entail legal proceedings and loss of reputation. it is more important than ever before that the management of health and safety risks be integrated in the overall management process itself, now that it is increasingly the norm to look at the health and safety record of a firm to get an indication of the quality of its management overall.
Some parts of industry may have been slow to recognise the above. They have often concentrated on taking decisions based on the results of risk assessments and failed to be sensitive to ethical, social and cultural considerations or played down the assumptions and uncertainties in the risk assessment thereby giving the impression that their results are based on sound science. Doubts have been expressed by some as to whether an approach based on risk assessment may be appropriate for the regulation of risks. This was witnessed by the controversy surrounding the proposals for the disposal of the Brent Spar oil platform in the UK, the collapse of the market for bottled Perrier water following their admission that their product had accidentally been contaminated by traces of benzene, the controversy surrounding Bovine Spongiform Encepalopathy (BSE). This paper describes the criteria known as the Tolerability of Risk (TOR) which HSE has developed to inform decisions about the degree to which risks should be regulated and/or controlled. It avoids the above pitfalls by taking into account the scientific knowledge about the risks concerned, the technology available for controlling them as well as public attitudes towards the risks and the benefits they engender. The criteria has gained considerable acceptance within industry.
Advances in Safety and Reliability: ESREL '97
29
RISK ASSESSMENT
The process of assessing risks is now an essential component of an effective strategy for countering the general hankering after a zero risk society, incorporating the management of health of safety in the decision-making process and rationalising the amount of resources that should be allocated for preventing or reducing risks. More importantly it is being increasingly recognised that used judiciously, it can be a powerful tool for re-assuring the public that science is being used for pursuing technologies whose benefits outweigh the risks and integrating public values in the decision making and political process. Assessing risks is simple in principle. It involves identifying hazards or examining what in a particular situation could cause harm or damage, and then assessing the likelihood that harm will actually be experienced by a specified population and what the consequences would be (ie the risks). As such, a risk assessment is essentially a tool for extrapolating from available data, a value or judgement which people will accept as an estimate of the risk attached to a particular activity or event. Though a sharp distinction is often made between risk assessment and risk management - the distinction is artificial. It stems from original beliefs - now known to be misguided - that assessing risks could be, by and large, a totally scientific and objective process unlike risk management which inevitably has to be more subjective because it has to take into account a host of other factors such as economic analysis, perception of risks, availability of alternative technologies, concerns about equity etc. In practice, an assessment of risks is also a very subjective process since it often cannot be undertaken without making a number of assumptions. Moreover, since a risk assessment takes account of measures already in place it invariably contains some elements of risk management. In short though the basic principles of assessing risks may be simple, applying them is not as simple. Indeed risk assessment nowadays more often than not is a composite of established disciplines, including toxicology, engineering, statistics, economics, demography and psychology. Knowledge of these disciplines is required to solve many of the practical problems - described below - that are encountered during the assessment process. Uncertainty
Uncertainties are inherent in the process of assessing risks. They all stem from imperfect knowledge and can be considered to be of two types. Known uncertainties or 'what you know you don't know'. For example a risk estimate may be based on models which are known not to describe certain aspects of a problem or utilises data which are known to be of limited applicability or accuracy. Unknown uncertainties on the other hand arise from sources which are either unknown to those making the risk estimate, or whose significance is not appreciated - 'what you don't know you don't know'. For example it may not be appreciated that a particular model is incomplete in its description of possible effects. In the last few years, development of better methods for tackling problems posed by uncertainty has become increasingly important. Several techniques are available for tackling both known and unknown types of uncertainties. For instance, sensitivity testing is often used to check the importance of assumptions to the final result. Small changes are made, within limits, in the data used and assumptions made, and their effects on the result of the assessment are then examined. Large changes are an indication that the assumptions need to be re-examined. A review of available methods for tackling uncertainty is beyond the scope of this paper. Its influence and ramifications for informing policy decisions have been examined by Ravetz et al. Risk Perception
People's attitude to risks is greatly influenced by they way they perceive them. Indeed the factors that tend to reflect society's concerns about the risks bear a marked similarity with those mentioned earlier as influencing people's attitude to science and technology. How the risk interacts with psychological, social, cultural, and institutional processes is important. Factors of particular importance include how well the
30
J.M. Le Guen
process (giving rise to the hazard) is understood, how equitably the danger is distributed, how well individuals can control their exposure, whether risk is assumed voluntarily and the number of people likely to be killed in any one incident and the trust that the public have in the regulator with responsibility for ensuring that those who create risks introduce appropriate measures to control the risks. THE REGULATION OF RISKS
Risk Criteria If they are to be successful, criteria for the regulation of risk must reflect society's values at large. As such they must take into account how people perceive risks and recognise that certain hazards give rise to societal concerns because people have an intrinsic dread of them or because they interact with the social aspirations, ethical beliefs and cultural ethos of society. Typical examples of such hazards include those associated with a nuclear power station, chemicals affecting the ozone layer or giving rise to global warming and biotechnology. Three broad 'pure' criteria have emerged for judging the tolerability of risk: equity-based, which starts with the premise that all individuals have absolute fights to certain levels of protection. This usually leads to standards held to be usually acceptable in normal life, or which refer to some other premise held to establish an expectation of protection. In practice, this often results in fixing a limit to represent the maximum level of risk to which any individual should be exposed. If the risk estimate derived from the risk assessment is above the limit, the risk is held to be intolerable whatever the benefits; c o s t / b e n e f i t b a s e d where some direct comparison is made between a value placed on the benefits of reducing risk of injury or detriment, and the costs of preventing and reducing the risks. This form of criterion may relate the comparison not to the overall benefits and costs, which may be very difficult to establish, but to the benefits and costs of an increment of risk reduction. In other words, cost/benefit based criteria compare the benefits in monetary terms obtained by the adoption of a particular risk prevention measure with the cost of introducing it. ' t e c h n o l o g y b a s e d ' . This essentially reflects the idea that a satisfactory level of risk prevention is attained when relevant best or good practice, or "state of the art" technology is employed.
The TolerabUity of Risk
The above criteria are not mutually exclusive. Indeed, all three are present in the framework that HSE has developed for deciding what risks are so great as to be unacceptable; so small that no further precautions are necessary; or, if they fall between these two states, whether the risks should be incurred, taking account of the benefits or the need to avoid some greater risk. The criteria known as TOR (short for tolerability of risk) are illustrated in the geometry at Figure 1. The horizontal line at the top represents an upper limit above which a particular risk for practical purposes is regarded as intolerable whatever the benefit. Any activity or practice giving l'{se to a risk greater than this threshold would be ruled out unless it can be modified to reduce the degree of risk below this level. The line at the bottom, on the other hand, represents a threshold below which risks are considered broadly acceptable because they compare with small risks which do not worry people or cause them to alter their behaviour in any way. When incurred they only result in a very small addition to the background level of risks to which everyone is exposed during their lifetime (typically 1 in a 100). Between the two lines is the region where people will tolerate risks in order to secure benefits. However, this tolerance of risks is buttressed by an expectation that people will be told the nature and level of the risks, and the confidence that the risks are being controlled as low as is reasonably practicable.
32
J.M. Le Guen
This region, known as the 'tolerability region', accommodates people's and society's willingness to live with a particular risk so as to secure social and economic benefits. Benefits for which people and society tolerate risks typically include local employment, lower cost of production, personal convenience and the maintenance of general social infrastructure for example through the availability of electricity, food or water supplies. However, while people may tolerate risks for which they can see some benefits that outweigh them and as such will indeed engage voluntarily in activities which often involve high risks, in general they want the risks to be as low as possible. Moreover, they are far less tolerant of risks imposed on them and over which they have little control. The concept of tolerability implies that existing control measures should be periodically reviewed to ensure that they are both properly applied and that they take account of changes over time, as for example, the availability of new options for reducing or eliminating risks due to technical progress.
To lerab ility limits The dividing line between the unacceptable and tolerable regions must reflect society's values at large and will depend on the nature of the hazards and the detriment they could give rise to. However, HSE has proposed that for hazardous events to which workers are exposed, a risk of death of 1 in 1,000 per year should be the dividing line between what is tolerable for the majority of workers for most of their working lives, and what is unacceptable for any but fairly exceptional groups. For members of the public who have a risk imposed on them "in the wider interest" HSE would set this limit at an order of magnitude lower - at 1 in 10,000 per annum. At the other end of the spectrum, HSE believes that an individual risk of death of 1 in 1,000,000 per annum for the public (including workers) corresponds to a very low level of risk and should be considered as broadly acceptable. In addition to those levels of individual risks, the HSE has suggested that the chance of an accident causing societal concerns due to multiple fatalities in a single event should be less than 1 in 1,000 per year and, if possible, less than 1 in 5,000 for accidents where there is some choice whether to accept the risk of it happening - for example by allowing the erection of a hazardous installation in a built-up area. The choice of the above figures is essentially a policy decision and they are not intended to be straight-jackets applied rigidly in all circumstances. The upper boundary was determined by analogy with high risk industries generally regarded as well regulated while the lower boundary took account of people's voluntary acceptance of risks in particular situations and risks that they usually regard as negligible in their walk of life. On the other hand the boundary for the level of risk for events causing multiple fatalities is roughly based on an examination of the levels of risk that people were prepared to tolerate for hazards causing a major accident affecting the surrounding population eg the survey carried out by HSE on the potential risks of the industrial installations at Canvey Island on the Thames or the predicted annual chance of an aircraft crash in the UK killing 500 or more people. Though the above tolerability limits are defined in terms of fatalities, it is possible to apply the framework for judging the tolerability of other forms of detriments (eg non-fatal injuries) by converting them into "fatality equivalents".
Typical persons Some of the tolerability limits mentioned above relate to individual risks. But this is not as straightforward as it seems. What is a typical individual? Individuals are affected by risk differently depending amongst other things on their physical make up, abilities, age etc.
Advances in Safety and Reliability: ESREL '97
33
When setting standards, tolerability limits, or control limits that apply to a particular activity whatever the circumstances, this problem is addressed by constructing a hypothetical type of individual or typical person who is in some fixed relation to the hazard, eg the person most exposed to it, or a person living at some fixed point or with some assumed pattern of life. Other individuals can then see how their circumstances relate to this typical person and reckon whether they or their family incur a greater or smaller risk. As such, typical persons may be regarded as persons (including groups) assumed to have homogeneous characteristics who are deliberately posited for the purpose of risk assessment. They may for example be persons hypothetically constantly present at the perimeter fence of a nuclear power station, or a group of workers presumed to be exposed to a given risk for exactly forty hours per week etc. It is therefore very important to understand that the determination as to where the risks from a particular activity lie in the TOR geometry (ie whether they lie in the unacceptable/tolerable/negligible region), is performed by calculating the risk to a typical individual exposed to the hazard under consideration for a specified period of time (usually a full working day) integrated over a full year. The calculations do not relate to the risk arising from the actual exposure of a real person to the hazard in question. Similarly, once it has been established where the activity lies in the TOR geometry, decisions on the measures that need to be taken across the board to control the risks relate to those needed to ensure the health and safety of the typical individual and not to those of an actual person undertaking the activity (though it may be necessary to adjust these measures to take account of any particular characteristic - eg a disability - peculiar to the real person). In short, the risks derived to the typical individual act as a pointer as to where the activity lies on the TOR geometry, which in turns dictates the type and degree of the measures that need to be introduced across the board to eliminate or to control the risks adequately. This approach of establishing for any circumstances the control measures that need to be introduced for protecting actual persons from risks, by looking at those needed to protect a typical individual, has an important consequence. Once these measures have been identified, they represent the measures that must then be introduced, even for short exposures, for protecting actual persons from the risks. For example if the risk in operating an unguarded power press, is found to be intolerable and a guard is necessary to make the risk tolerable, then the guard will need to be in place, however short the period it is being used. Nor is it admissible to arguethat there is no need to introduce risk control measures for a high risk activity because in practice the risk is shared between many employees to ensure that the risk to any one individual is low. REDUCING RISK AS L O W AS IS REASONABLY PRACTICABLE In practice most risks will fall into the 'tolerability region' which will require those having a duty to control the risk to decide whether the risks have been reduced as low as is reasonably practicable (ALARP). The first step is to look at whether relevant good practice has been adopted. Where relevant good practice is not established, duty-holders will be expected to apply risk-reducing measures balanced against their associated costs through a cost benefit assessment. In general the higher the risks the more the balance should tilt in favour of adopting the measures unless their costs are clearly excessive compared with the benefit of the risk reduction.
Placing a Monetary Valuation on Benefits Cost benefit assessments can often be done on the basis of common sense judgement and without the explicit valuation of the benefits. However, there are also many situations where the benefits of reducing risk can be valued explicitly. This requires agreement on protocols since the health and safety of people and protection of the environment are not things that are bought or sold. It is therefore difficult to find market transactions to gauge their value directly.
34
J.M. Le Guen
Nevertheless, many techniques have been developed for putting a monetary value on risk reductions to human life and health. For example, by comparing property values, it is possible to estimate how much people actually pay for cleaner air or more attractive scenery. Or again by looking at how much more people are prepared to pay for a car fitted with an airbag it is possible to gauge what people are prepared to pay for achieving a marginal reduction in the risk of death. Similarly, by examining how much extra is paid for undertaking particularly dangerous jobs one can estimate what monetary compensation people require for a marginal increase in the risk of death. HSE in undertaking cost benefit analyses currently attributes a value of £8 for a reduction in risk of death of 1 in 100,000 per year - unless the risk is particularly dreaded or is near the margin of tolerability and subject to large uncertainties when higher values are used. CONCLUSIONS Individuals tolerate different levels of risk depending on the benefits they think they will gain from taking the risks. Equally, society's tolerance of different risks varies dramatically for a whole variety of reasons, which have at their roots deep-seated, psychological attitudes and beliefs. A philosophical framework which makes use of the results of a risk assessment can provide a structure for informing decisions on the risks that society and individuals are prepared to accept and for communicating how these decisions were reached. However, for the tool to work, all those who rely on it have to understand its nature and its limitations - in particular that it relates to typical rather than actual persons; that the process is assumption and value-laden and subject to uncertainties. In short, acceptance of decisions on risks has to take account of values established by informed debate and people's willingness to tolerate risks in return for benefits. HSE has developed and published such a framework, known as TOR, for establishing how far it is reasonable to regulate and control risks having regard to established good practice; the impact of technological change; the uncertainties attached to risk estimates and not least how people perceive risks and which one there are prepared to tolerate. Since its publication, HSE has found it extremely useful for justifying its regulatory decisions, targeting the allocation of resources and reaching judgements on what is reasonably practicable when enforcing the law. It has also helped to make decisions informed by the results of a risk assessment more acceptable. More and more firms are becoming aware that the public mood has changed and that they have to be open and transparent about the risks they create and the measures they have in place for preventing or controlling those risks. TOR provides an established framework for putting such information in the public domain. Though it may not bring back the optimism of the 1900s, many have found it a most useful tool in their attempts to dispel the malaise surrounding their industry.
REFERENCES Funtowicz Silvio O. and Ravetz Jerome R. (1990). Uncertainty and quality in Science for Policy, Kluwer Academic Publishers ISBN 0 7923 0799 2. Health and Safety Executive (1992). The Tolerability of Rbskfrom Nuclear Power Stations, page 32, paras 181183, HMSO, London, ISBN 0 11 886368 1.
A2" Risk Perception
This Page Intentionally Left Blank
PUBLIC PERCEPTIONS OF RISKS ASSOCIATED WITH M A J O R INDUSTRIAL HAZARD SITES A. Brazier ', A. Irwin2, C. Kelly3, L. Prince 4, P. Simmons 5, G. P. Walker6, B. Wynne 5 'Major Hazards Assessment Unit, Health and Safety Executive, Bootie, Merseyside, UK 2Department of Human Sciences, Brunel University, Uxbridge, Middlesex,, UK 3Ergonomics and Work Psychology, Health and Safety Laboratory, Sheffield, UK "INLOGOV, Birmingham University, Birmingham, UK 'Centre for the Study of Environmental Change, Lancaster University, Lancaster, UK 6Division of Geography, Staffordshire University, Stoke on Trent, UK
ABSTRACT This paper reports on research commissioned by the Health and Safety Executive in the context of the forthcoming Seveso II Directive, to help understand how members of the public perceive the risks from major hazard installations. The research is based on comparative case studies of seven hazardous installations and uses complementary data collection and analytical methods, including contextual research, focus group discussions, siting scenarios and Q-sort exercises. The purpose, rationale, methodology and emerging results of this major 3 year research project are discussed.
KEYWORDS Risk, perception, tolerability, siting, policy, UK.
INTRODUCTION In the UK statutory controls over major hazards are designed to identify sites with a major hazard potential, to prevent and reduce the severity of accidents through requirements for safe operation, and to mitigate the consequences of accidents which do occur, through emergency planning, information to the public and land-use planning. In accordance with the role envisaged under the Seveso II Directive (Commission of the European Communities 1994, Walker 1995) the Health and Safety Executive (HSE) provides expert technical advice on risks that would be posed by new hazardous installations and risks from existing installations to proposed development in their vicinity. Planning advice is also given on the risks from notified pipelines and licensed explosives sites. The Seveso II Directive will require information on safety 37
38
A. Brazier et al.
measures and emergency planning to be made available to persons liable to be affected by a major accident originating from a major industrial hazard site. To prepare for the implementation of the Directive, HSE has commissioned an interdisciplinary research project to help understand:the level of public comprehension of hazard and risks from major hazard sites, for example, awareness of the nature and extent of these risks, and the sources of this information. public perception of these risks, that is, of the perceived likelihood of a major accident, compared with other perceived risks, and how this perception compares with assessed risk levels. the level of risk the public is willing to tolerate from major hazards, and the factors which influence attitudes, such as economic benefit, the public image of a company good neighbour policies, etc.
PRACTICAL APPLICATION OF THE RESEARCH The primary purpose of the research is to assist HSE and other Government Departments: • • • • •
to to to to to
develop policies on the tolerability of risk develop criteria for the siting of major hazards and the use of land within their vicinity explain risk issues to local planning and hazardous substances authorities and to the public evaluate the effectiveness and impact of legislation provide a baseline of knowledge from which to measure future change.
THE RESEARCH IN CONTEXT The research forms part of a wider HSE behavioural and social sciences research programme and coincides with both the revision of the HSE publication on the Tolerability of Risks from Nuclear Power Stations (HSE 1992) which is being redrafted to encompass other industries and the revision of the 1989 HSE discussion document (HSE 1989) which suggested quantified risk criteria for land use planning within the vicinity of major industrial hazards and outlined the rationale underpinning these criteria. In light of the many comments received on the discussion document and a further six years experience of their use HSE is revising the document to include more definitive approaches and criteria for control to include recommendations on:• • • • • •
the siting of new hazardous installations the tolerable risks from existing installations the further development of land in the vicinity of such installations the tolerable risks to existing development in the vicinity of such installations the location of pipelines containing hazardous substances the control of developments (both new and existing) in the vicinity of such pipelines, and touches on • the local control of dangerous substances transportation risks (to dovetail with the recommendations made in the 1991 HSE Report on the transportation of dangerous substances in major hazard quantities)
EXISTING RESEARCH BASE
Although major hazards have been recognised as a particular category of technological risk for over 20 years, there have been comparatively few studies of how the public perceive these risks. Much risk perception research has been concerned with how the public perceive multiple forms of risk in the abstract,
Advances in Safety and Reliability: ESREL '97
39
rarely including major hazard risks amongst the list of risks to be considered. Where work has been focused on particular forms of environmental risk, nuclear power and radioactive waste have figured most prominently (e.g. Van der Pligt 1992, Macgill 1987, Wynne et al 1993) with hazardous waste landfill and incineration also receiving significant attention in the US. One limitation of this latter body of work, in relation to the present research project, is that it deals with populations affected by persistent and often undetectable toxic risks of a kind that have a particular cultural resonance because of their associations with notions of 'contamination' that arouses particular public anxieties (Erikson, 1990, Beck, 1992). Although some large chemical installations may be perceived as presenting a similar risk to local populations, in the case of many major accident hazards the risk of this sort of toxic exposure (and its powerful cultural associations) is absent. In the UK there has been a relatively small number of pieces of work concerned with major hazards. Social and Community Planning Research (Prescott-Clarke 1980, 1982) undertook a study of public perceptions of a range of risks incorporating analysis of perceptions of' major hazards, through a small-scale, qualitative feasibility study on Teesside and a larger nationally representative quantitative survey. The latter (Prescott-Clarke 1982) revealed a number of interesting patterns of perception but without analysing them in any real depth. For example, it was found that the nearer someone lived to a major industrial site the less likely they were to consider that such sites collectively posed a risk to the public, but the underlying reasoning behind this spatial trend is not explored. The discussion of the results of the focus group work on Teesside (Prescott-Clarke 1980) is in some ways more revealing, with selected quotes beginning to open up to dimensions of trust in regulators, economic dependency and industry-community relations. Smith and Irwin (1984) undertook a survey of public perceptions of risk in the vicinity of major hazard industry in Halton in Cheshire, concluding that in neither of the two survey areas, 'did the risks associated with factory accidents emerge as a major concern'. However, they questioned the value of attitudinal survey evidence, stressing the dangers of over-generalisation and the need to recognise the diversity and contextual nature of risk attitudes. A number of studies have also considered public perceptions and responses in the context of information given out to the public under the CIMAH Regulations. These include research contributing to comparative European studies led by Brian Wynne (1987, 1990) and work undertaken by Jupp and Irwin (1989)around the Carrington complex in Manchester. Irwin (1995) discusses the results of questionnaire and semi-structured interview work around plants in Eccles and Clayton/Beswick which found a generally high level of concern about factory accidents and pollution sitting alongside other concerns such as unemployment, crime and violence. The trust placed in various possible disseminators of information about hazards is explored, revealing a low level of trust in industry but also an overall pattern of scepticism and wariness about information sources. It is stressed that both the hazards and their perception are very much embedded in the nature of the locality and the lives of local people, so that they are 'an intrinsic part of everyday social reality and the very identity of these areas' (ibid.). Looking beyond the UK, a number of studies in the Netherlands have examined public perceptions of major accident hazards. Vlek and Stallen (1981) and Stallen and Tomas (1988) report on the results of research undertaken around the port of Rotterdam, using a number of different approaches to studying public risk perceptions. The initial study involved 700 people responding to a psychometric questionnaire, asking about their personal judgements of various risky activities. Three pairs of cognitive dimensions underlying sets of individual judgements were identified - riskiness, beneficiality and acceptability- but Vlek and Stallen emphasise the limitations of the study (despite its scale), such as the problem of group average ratings hiding substantial differences in understanding and interpretation, and raise doubts over the meaning of comparisons made between major hazards and other very different types of risk. A later follow on study in the Rotterdam area sought to extend this work by focusing on 'feelings on insecurity' when faced with the threat of a major accident, and the importance of 'personal control' in the response made to insecurity. Four types of response to the threat of major hazards are identified - secure, accepting, vigilant and defensive with their occurrence amongst the 600 interviewees analysed by spatial proximity to major hazard sites and gender. Little variation across space is found, although women are found to be more anxious about the risks because they value matters of personal health and well-being more highly than men. In particular, Stallen
40
A. Brazier et al.
and Tomas argue, that it is important to look at the context of statements made about risk, as the intensity of feeling about a threat is only one aspect of a more involved qualitative structure of the affect. In a study undertaken in the vicinity of the DSM chemicals complex in south Holland and further afield as a control group, Wiegmann, Gutteling and Boer (1991) set out to explain the apparently greater level of acceptance of risk found in the vicinity of the hazard in Stallen and Tomas's study (a phenomenon also observed in survey research in the Halton study referred to above). Economic dependence upon the industry was found to play a part in this phenomenon but only appeared to account for a small proportion of the variation. They conclude that social learning theory, a cognitive theory which assumes that through a process of experiential verification the residents near the chemical complex are less affected by the 'biased' accounts of industry risks offered in the media, offers the best explanation of this effect. When contrasted to the results of the research around nuclear power, radioactive and toxic waste sites, these studies pose interesting questions about the rather different patterns of local perception of major accident risks. Whilst there are clearly differences between the political culture of the UK and other countries, it may also be that the cultural valency, and therefore individual perceptions, of these different types of hazards plays a significant part in accounting for these different patterns of response. One limitation of most of these existing studies has been the use of a single research method or a focus on a single major hazard site (albeit with other control sites in the case of the Dutch studies). This is where we anticipate that the approach to be adopted in the present study, involving both multiple sites and a combination of psychological and socio-cultural research methods, will provide some further insight into the issues that have been raised.
APPROACH TO THE RESEARCH The approach adopted by the research team to the study of how people experience the risks associated with major hazard sites, sees the various dimensions of awareness, comprehension, perception and toleration as closely intertwined (to the extent that it may be very difficult to separate them). Our approach also sees this experience as being formed in a specific local context. It follows that central to developing an understanding of risk perception will be an exploration of the interaction of risk perceptions with attitudes towards other aspects of industry, the local area, local regulatory bodies and the broader social and economic context within which the local community is situated. This perspective in turn influences the research methods chosen and the overall research design. The comparative research design is also intended to enable us to investigate a number of more specific issues raised by recent risk perceptions research both in Britain, Europe and the USA. In particular, within the overall aims specified earlier, the research will seek to: • • • •
draw out the extent of diversity, consistency and stability of perceptions amongst different publics, rather than seeking only some homogenised view of a putative local 'community'. explore the differing roles of national and local level influences on perceptions of risk from industrial sites. examine the role of dimensions of credibility and trust in industry and regulators in risk perceptions. examine the influence of implicit senses of empowerment or powerlessness held by members of the public on their interest in and willingness to take up information about hazards and emergency arrangements.
RESEARCH DESIGN Case study site selection
Seven case study major hazard sites are being examined. These have been selected by the research team in consultation with the HSE, in order to provide variety in the following characteristics:
Advances in Safety and Reliability: ESREL '97 • •
• • • •
41
the nature of the hazard at the site (toxic, explosive/flammable) the designation of the site as a top-tier 'Seveso Directive' installation, referred to in the UK as a CIMAH ( Control of Industrial Major Accident Hazards Regulations 1984) site , or as a lower inventory installation referred to in the UK as a NIHHS (Notification of Installations Handling Hazardous Substances Regulations 1982) site. CIMAH sites will have disseminated information to local publics whilst there is no such requirement for NIHHS sites the physical size of the installation (ranging from a major complex to a warehouse) the length of time the installation has existed the history of accidents or publicised incidents at the plant the socio-economic characteristics of the surrounding population (derived from census data)
We were also constrained by the need to have a reasonably substantial population living near to the hazardous site. For this purpose we used census data to estimate how many people lived within the 'consultation distance' (CD) specified around each installation by the HSE. We have so far completed field work in three of the case study areas and details of these are shown in Table 1. Further case study sites are to include a major chemical/petrochemical complex, a warehouse holding ammonium nitrate and a stretch of'major hazard' pipeline. TABLE 1 CASE STUDY SITES
Company
Site
Hazard No. of Type Employees
!Albright Langley, CIMAH and Wilson Sandwell,West Toxic Midlands
Size
Year Established
Extent of CD
Population in CD
600
55 acres
1851
750-1000m 7,980
Allied Colloids
Low Moor, CIMAH Bradford, West Toxic Yorkshire.
2000
42 acres
1953
1300m
1,890
Rohm and Haas
Jarrow, South Tyneside
220
14 acres
1955
400m
1,950
NIHHS Toxic
Contextual research
The initial stage in the work in each case study area is to carry out contextual research. We see this as an important element in the research design. It involves, first of all, a search of information sources held in local studies libraries and archives. These include local press reports, local histories, industrial and company histories, local development plans and ordnance survey maps of the area. This research is supplemented by interviews with key local actors including site management at the company, the HSE Inspector responsible for the site, emergency planners, land use planners, the chair of the local liaison committee, together with other people from the local community such as head teachers of schools near to the site or, in cases, local councillors. Focus groups
The main method for finding out about how people perceive, understand and feel about risk is through focused group discussions. The advantage of focus groups as a method for this kind of research is that they provide a context in which people interact with one another. This creates an opportunity to observe the way
42
A. Brazier et al.
in which people's views are formulated, expressed and challenged. It establishes a far more dynamic and in certain ways more revealing research situation than a one-to-one interview or a survey. Focus groups have not been widely used in risk perception research (Wynne et al 1993) but are extensively used in social research more generally. The approach that we have developed involves recruiting 6 groups of 6-8 local people in each area (without informing them of the principal themes of the research). Each group meets twice. Each meeting lasts ninety minutes and the two meetings take place about three weeks apart. In the first meeting a discussion guide is used and participants are led through a list of topics, beginning with their views about the area and gradually focusing in on the major hazard site. At the end of the meeting the Q-sort exercises (see below) are demonstrated to participants and they complete these in the period between the two meetings. The second meeting begins with a discussion of three stimulus sheets containing quotations which express different points of view about (a) the provision of public information about industrial hazards, (b) the regulation of industry and (c) who should be responsible for setting safety standards. In the second half of the meeting we employ two sets of materials which use planning and facility siting scenarios to stimulate discussion of a variety of risk issues, including questions of risk assessment criteria and societal risk. The first of these scenarios involves deciding about the location of new housing in the vicinity of an existing hazardous installation in an already built up area. The second relates to a choice between two possible locations for a hazardous plant extension.
Q-method Q-method is a pattern analytic technique developed for the study of subjectivity. It has been used in a range of disciplines, most notably political science, but has been employed to only a limited degree in previous studies of risk perceptions. In this project we have produced two Q-sort exercises which all the people involved in the focus groups undertake. One is concerned with people's sense of place. The second is concerned with their view of the local major hazard site. Using Q-method first involved the collection of statements about major hazard sites from a range of different sources. A sample representing the range of statements was then created and from this we produced a set of cards, each containing a single statement related to the local major hazard site. They were asked to sort the cards into a predetermined pattern according to the strength of their agreement or disagreement and to record the resulting configuration on a form provided. The resulting arrangement of cards for all participants is then subjected to factor analysis to reveal any underlying patterns or factors. These factors represent distinct points of view which to a greater or lesser extent are held in common by some of the participants. Interpretation of these factors is subsequently validated by returning to interview a few individuals whose Q-sorts exemplify a particular factor or point of view. Some contrasting examples of the statements that people are asked to sort on major hazards are as follows: ' An industrial accident that would harm local residents is extremely unlikely.' 'The safety of local people is a top priority for Allied Colloids.' ' No-one forces people to live here - if they think its too dangerous they can always move out.' ' The chemical industry is just a threat to everyone's health and safety.'
PRELIMINARY ANALYSIS AND RESULTS As the research project is yet to be fully completed, discussion of results must be preliminary and tentative. However certain themes have emerged from the focus group sessions and analysis of the Q-sort data is initially revealing some common patterns of response.
Advances in Safety and Reliability: ESREL '97
43
Focus group." comparative themes and issues Initial thematic analysis of the focus group data has identified a number of issues and themes relevant to our understanding of people's perceptions and toleration of risks associated with these sites. These issues appear in various ways across all three case studies. They are: • • • • • • •
the influence of what we have called 'local memory' on perceptions of a site, this collective memory sometimes extending back a long time and passing from generation to generation the importance of experience of incidents in shaping local discussion and perceptions and relationships between the company and the local community the way in which inferences about risk are drawn from sensory 'evidence' such as smells, visible plumes, the general appearance of the site and the quality of local nature the way in which people reason about risk, in relation to probability and consequence arguments, trade-offs between risk and other concerns and the scope for individual choice in risk-taking the stigmatisation that can result from the presence of a hazardous site and the implications this has for local identity the variety of images that people hold of the company and the range of ways in which initiatives by the company, such as open days, community newsletters, and liaison groups are responded to the strength of views on regulation and regulators and the expectations of and trust in regulatory practice that are expressed
Q-sort data Our initial analysis of the Q-sort data has found that in each area two clearly differentiated, orthogonal factors, or points of view, emerged. In each case the strongest of these was a point of view which was in general distrustful of the company and had little confidence in the regulators or in the emergency services. This point of view was also characterised by concern about the risks associated with the site. The second factor represented a contrary point of view which, in general was more trusting in the competence of the company, the regulatory authorities and the emergency services and which consequently tended to be more tolerant of the risks. Significantly, very few of the participants in these case studies appeared to hold such a robust view. A comparative analysis of the factors identified for all three sites found them to correspond very closely, confirming that we were finding very similar patterns of response at all three sites. The most significant differences between the factors can be accounted for by specific differences in the local contexts. CONCLUSION The experience of bodies dealing with risk concerns has repeatedly shown the importance of developing a better understanding of public risk perceptions. However, despite much research over the past twenty years that understanding remains somewhat elusive. There is a need for research which deals with the perception of particular forms of risk in the settings and contexts in which these are experienced and which more explicitly recognises that living with risk is very much part of everyday life for many people. In the case of major accident hazards we have argued that such research must involve a locally focused and contextualised approach, which allows people, as much as possible, to discuss and express points of view in ways which they define and determine. Such an approach is also needed if we are to develop a deeper understanding of why particular perceptions of risk are held and the stability and certainty of particular points of view. The use of focus groups allied with q-method we have described in this paper, provides an innovative and effective approach to meeting these objectives and to the formulation of a range of recommendations for the development of major hazard policy and regulation in the UK.
44
A. Brazier et al.
REFERENCES Beck U (1992) Risk Society: Towards a New Modernity, Sage, London, UK. Commission of the European Communities (1994) Proposal for a COUNCIL DIRECTIVE on the control of major accident hazards involving dangerous substances (COMAH). COM(94) 4 final: Brussels 26.01.94 Erikson, K. (1990) Toxic Reckoning: Business Faces a New Kind of Fear, Harvard Business Review, Vol. 90:1, pp. 118-126. Health and Safety Executive (1989) Risk Criteria for Land use planning in the vicinity of Major Industrial Hazards, HMSO, London, UK. Health and Safety Executive (1992) The Tolerability of Risk from Nuclear Power Stations, HMSO, London Irwin, A. (1995) Citizen Science. A study of people, expertise and sustainable development, Routledge, London, UK. Jupp, A. and Irwin, A. (1989) Emergency Response and the Provision of Public Information under CIMAH, Disaster Management, 1:4. Macgill, S.M. (1987) The Politics of Anxiety, Pion, London, UK. Prescott-Clarke, P. (1980) Public Attitudes Towards the Acceptability of Risks, Social and Community Planning Research, London, UK. Prescott-Clarke, P. (1982) Public Attitudes Towards Industrial Work Related and Other Risks, Social and Community Planning Research, London, UK. Smith, D. and Irwin, A. (1984) 'Public Attitudes to Technological Risk: the Contribution of Survey Data to Public Policy Making', Transactions of the Institute of British Geographers, 9. Stallen, P.J.M. and Tomas, A. (1988) Public Concern about Industrial Hazards, Risk Analysis, 8:2, pp. 237-245. Van der Pligt, J. (1992) Nuclear Energy and the Public, Blackwell, Oxford, UK. Vlek, C. and Stallen, P.J. (1981) Judging Risks in the Small and the Large, Organizational Behaviour and Human Performance, 28, pp. 235-271. Walker, G. P. (1995) Land use planning, industrial hazards and the 'COMAH' Directive, Land Use Policy, vol. 12, no. 3, pp. 187-191. Wiegman O, Gutteling JM and Boer H (1991) Verification of Information through Direct Experiences with an Industrial Hazard, 12:3, pp. 325-339. Wynne B (1987) Implementation of Article 8 of the EC Seveso Directive: A Study of Public Information, Report to the European Commission, DG XI. Wynne B (1990) Empirical Evaluation of Public Information on Major Industrial Accident Hazards, Report to EC Joint Research Centre, ISPRA Wynne B et al (1993) Public Perceptions and the Nuclear Industry in West Cumbria, Centre for the Study of Environmental Change, University of Lancaster, Lancaster, UK.
SOCIETAL RISK AND THE CONCEPT OF RISK AVERSION J.K.Vrijling and P.H.A.J.M. van Gelder Department of Civil Engineering, Delft University of Technology Stevinweg 1, 2600 GA Delft, The Netherlands
ABSTRACT It seems generally accepted that the FN-curve is a fairly accurate description of the societal risk. However in the communication with the public and representative decisionmakers a schematisation of the FN-curve to one or two numbers may bring certain advantages. Various measures like Potential loss of Life, the area under the FN-curve, the Risk Integral etc. are proposed in the literature. Although the formulae look distinctly different at first sight a more thorough inspection reveals, that all schematisations contain as building blocks the two familiar statistical moments of the FN-curve, the expected value of the number of deaths E(N) and the standard deviation ~(N). In the paper the linear combination E(N) + k.cy(N) is proposed as a simple risk averse measure of the societal risk.
KEYWORDS
Risk analysis, acceptable risk, societal risk, individual risk, risk aversion, decision making.
INTRODUCTION
There is general agreement in the literature and in regulatory circles that risk should at least be judged from two points of view (VROM (1988,1992), HSE (1989)). The first point of view is that of the individual, who decides to undertake an activity weighing the risks against the direct and indirect personal benefits. This first point of view leads to the personally acceptable level of risk or the acceptable individual risk, defined in as "the frequency at which an individual may be expected to sustain a given level of harm from the realisation of specified hazards". The specified level of harm is narrowed down to the loss of life in many practical cases. The second point of view is that of the society, considering the question whether an activity is acceptable in terms of the risk involved for the total population. Commonly the notion of risk in a societal context is reduced to the total number of casualties (VROM (1988,1992), HSE (1989)) using a definition as by IoCE (1985): "the relation between frequency and the number of people suffering from a specified level of harm in a given population from the realisation of specified hazards". If the specified level of harm is narrowed down to the loss of life, the societal risk may be modelled by the frequency of exceedance curve of the number of deaths, also called the FN-curve due to a specific hazard. 45
46
J.K. Vrijling and RH.A.J.M. van Gelder
The FN-curve can be seen as an exceedance curve with a related probability density function (p.d.f.) of the number of deaths. The p.d.f, of the number of deaths Ndij given an accident for activity i at place j can have many forms. A few types are presented here to stimulate further thinking. The first conditional p.d.f, is the Dirac, that limits the outcomes to exactly N fatalities. Other possibilities that allow a larger variation in the outcome, are the exponential and the log-normal p.d.f. The probability of exceedance curves of the number of fatalities, that can be derived from these two forms reflect to some extent the FN-curves found in practical quantitative risk assessment (QRA) studies. A fourth is the inverse quadratic Pareto distribution that coincides precisely with the norm put forward by the Ministry of VROM (1988). The Pareto p.d.f, has no finite standard deviation unless the right tail is truncated (Fig. 1). Exactly the same models could be applied for the material damage that results from a disaster, if the horizontal axis is measured in monetary units. It should be noted that the proposed conditional p.d.f.'s have to be multiplied with the probability p of an accident and that the outcome zero fatalities with probability (lp) should be added to find the complete p.d.f, of the number of deaths (Fig.l). The classical measures of expected value and standard deviation will appear to be very useful numbers to classify the risk. probability density function ECN wu ) I-p.
VAR(I~
:
probability of exceedance
2. p
m~j) -- 2 .
,.
LN (N ~AX )
m
2P
r
•
I
N
HA)(
X
•
~ M,I~C
Inverse quadratic Pareto
Figure 1" A theoretical p.d.f, and probability of exceedance curve for the number of deaths. A controversy is found on the way to judge and limit the societal risk. Many apparently different judgemental numbers and normative decision rules can be discemed as will be shown below.Also the question of these numbers and rules include risk aversion is the subject of debate. Some analysis makes however clear that the rules and numbers proposed in the literature fall in two categories: risk neutral or risk averse. The direction of the development seems to be towards risk averse measures, although this trend is somewhat obscured by mathematical complexity.
D I F F E R E N T MEASURES AND LIMITATIONS OF SOCIETAL RISK It seems generally accepted that the FN-curve is a fairly accurate description of the societal risk. However in the communication with the public and representative decision makers a schematisation of the FN-curve to one or two numbers may bring certain advantages. As to the limitation of the societal risk to acceptable levels many different rules are proposed by scientists and regulatory bodies. Disagreement is especially found on the question if societal risk should be judged with a risk averse or a risk neutral attitude. One of the oldest simple measures of societal risk is the Potential Loss of Life (PLL), which is defined as the expected value of the number of deaths per year:
Advances in Safety and Reliability: ESREL '97
47
E (N) = ~ x. f Ndij (x). dx (1) where
: fNdij --
the p.d.f, of the number of deaths resulting from activity i in place j in one year
Ale (1996) has proposed the area under the FN-curve as a simple measure of societal risk. Although this is not immediately clear, it can be mathematically proven that the area under the FN-curve equals the expected value of the number of deaths (appendix 1).
E(N) =
I(1-
FNdij(x))dx (2)
An absolute limit to the expected value of the number of deaths is not mentioned in the literature. The use of the expected value seems very valuable in the comparison of various alternatives. VROM(1988) limits the societal risk at plant level by a line that is inversely proportional to the square of the number of deaths. This absolute requirement that formed the basis for the regulation and the siting of hazardous installations or new developments in the Netherlands during the last decade reads:
10 4 X
2
(3) for x > 10 deaths, where : FNdij = the c.d.f, of the number of deaths resulting from activity i in place j in one year (the subscript dij will be obmitted further on). The HSE (1989) remarks that the judgement of the societal risk at plant level by the VROM-rule is overly risk averse. HSE proposes to change the value of the exponent in the expression from 2 into 1 in order to form a more even judgement. In recent papers Cassidy (1996) of HSE defined the risk integral RI as an appropriate measure of societal risk that should be further explored: R I = I x. a - G ~x)). ax
(4) A limiting value is however not yet attached to this new concept. Vrijling (1995) notes that the societal risk should be judged on a national level by limiting the total number of casualties in a given year in the following way:
E(Na~) + k cy(Nm) < [3~ I00
(5) where : k - risk aversion index. The formula (5) accounts for risk aversion, which will certainly influence acceptance by a community or a society. Relatively frequent small accidents are more easily accepted than one single rare accident with large consequences, although the expected number of casualties is equal for both cases. The standard deviation of
48
J.K. Vrijling and RH.A.J.M. van Gelder
the number of casualties will reflect this difference. The risk aversion is represented mathematically by increasing the expectation of the total number of deaths, E(Nd~), by the desired multiple k of the standard deviation before the situation is tested against the norm. Rule (5) can be transformed into a similar expression valid at plant level by taking into account the number of independent installations NA. It can also be transformed mathematically into a VROM-type of rule applicable at plant level as shown in the same paper:
1- FNd,(X) _ 10
x
: I ~' 10012 where C,
[.k ~--AAJ (6)
For values of 13~= 0.03, k = 3 and NA = 1000 the rule equates exactly to the VROM-rule, which appears to be a specific case in a more general framework. Bohnenblust (1996) judges the number of casualties after correction with a factor q~(x) in an economic framework. Weighing the societal risk SR in the light of the cost of measures to improve safety an optimal decision is reached. Changing the summation into an integral the expression proposed by Bohnenblust reads:
Sl~ :
I x. , (x). G (x). & (7)
Although not explicitly stated by Wehr and Bohnenblust (1995), it can be deduced from a graph in the paper that (p( x ) - ~/(x/10). So the SR measure could be expressed as:
SR = I ~ l O. x 's. f u (x). dx
(8) THE RISK ATTITUDE OF THE VARIOUS RULES
First it should be stated that in this paper a decision based on the expected value only is called risk neutral. Risk neutrality can be modelled with a linear utility function. In case of a risk averse attitude a smaller standard deviation is preferred above a larger in case of equal expected values. In the literature this is frequently modelled by quadratic utility functions. To show the principle the expected utility is evaluated below for a linear and a quadratic utility function: In case of risk aversion the standard deviation starts to play a role. However the strict fipplication of quadratic utility curves has as a disadvantage that the units become [death 2/year], which is difficult to communicate to the public and most probably also to decision makers.
~ ax. f N (x). dx = a. E (N)
~ a x2. f u (x).dx = a.(E (N ) 2 + ~ (N ) 2) (9)
Advances in Safety and Reliability: ESREL '97
49
Using the concept of risk attitude the PLL and the area under the FN-curve, that are both equal to E(N), can be classified as risk neutral measures of the societal risk. The rule proposed by Vrijling(1996), containing E(N) + k.(~(N), is clearly risk averse. Consequently the VROM-rule which is proven to be a special case of this rule can be similarly classified as risk averse. If the exponent of the VROM-mle is changed into 1 as is proposed by HSE only the expected value of the number of casualties is limited, which according to the definition given above should be called risk neutral. The measure proposed by Bohnenblust (1995,1996) has an intermediate position with an exponent of 1.5. It is very interesting to note that is can be mathematically proven (appendix 2) that the risk integral proposed by Cassidy (1996) of HSE equals:
1
2
RI = ~x.(1-Fu (x)).dx = -j(E2(N ) +c ( N ) ) (10) Apparently the need for a simple risk averse measure to schematise the FN-curve is also felt in the United Kingdom. A disadvantage of the risk integral RI might be that the units are [death 2 /year] and some difficulty will be met in formulating an easy to understand limiting value.
CASE STUDY The half of Holland that lies below the sea level is divided in NAi= 40 more or less independent polders surrounded by dike-rings. If it is assumed that at some future date each polder will house Npij= 1,000,000 inhabitants, an estimate of the number of casualties in case of flooding can be made. In 1953 approximately 1% of the inhabitants drowned, giving a value of pdjn=0.01. Little is known of the influence of modem technological development on this number, but the failure of energy and communication networks during the minor floods in Limburg point to a limited beneficial influence. The expected value and the standard deviation of the number of deaths in 40 independent polders per year are equal to:
E(Ndi )
=
40pj 10-210 6
cy 2(Ndi) = 40pj (1 - p j )(10-210 -6 )2 (11) If these expressions are substituted in the norm Eqn. 5 the solution for 13i=l becomes pnj= 3.10 -7 per year. In case the aversion of the inhabitants against flooding is more extreme and [3 i= 0.1 the acceptable probability of failure of the dike ring is pf~j= 3.10 .9 per year.
50
J.K. Vrijling and RH.A.J.M. van Gelder 10 0 ,
,
,
,
,
,
,
, , ,
,
,.
,
,
,
, ,
,,
,
,
,
,
,
,
, , i
,
,
,
,
,
,
,
,,,
,
,
,
,
,
,,
,,
,
,
,
,
,
,
,,~
,o_2
....i---ii--ii-!i-ii-i-!ii ....Fi"i':i;i'ii'i!!i
=ol
.
, ~ 10 .6
.....................
.
;
,-. lO-12 i
.
.
.
.
.
.
.
.
.
.
.
.
iiiiiiiiiiiiiiiii i iiiiiiiiiiiiiiiiiiiii iiiiiiiiiiiilliii
1 o 14
v
1 01
102 Number
103 of fatalities
104
N
Figure 2." FN-curve for flooding of the Brielse polder For the Brielse dike ring near Rotterdam a FN-curve (Fig.2) has been drawn estimating the probability of failure of the existing dikes at 10-4 per year. The FN-curve shows that there are five equally likely scenario's with death counts varying from 15 to appr. 5000 people. As these scenario's are assumed to be independent, the combinations, that claim even more casualties, are less likely by an order of magnitude. Developing the local criterion for a dike ring using the values mentioned above, the constant becomes C i - 27.8 - 0.278 for 13 - 1-0.1. Thus the present situation based on the philosophy developed by the Deltacommittee (1960) seems insufficiently safe in the light of modem developments. Following the normative framework developed here the acceptable probability of failure of the dike equals 6.3.10 .7 to 6.3.10 .9 depending on the value of 13 •
CONCLUSIONS Although the FN-curve, the exceedance curve of the number of deaths, is generally accepted as a clear representation of the societal risk regarding the loss of human life, a search for one simple number to express the societal risk can be observed. Several schematisations of the FN-curve are proposed. Some of these schematisations are completed with a limiting value to provide a decision rule. Although the formulae look distinctly different at first sight a more thorough inspection reveals a common approach that promises a relatively rapid convergence of opinions. It appears that all schematisations contain as building blocks the two familiar statistical moments of the FNcurve, the expected value of the number of deaths E(N) and the standard deviation c~(N). The Potential Loss of Life (PLL) measure and the area under the FN-curve, as a simple measure of the societal risk, are both equal to E(N). However no absolute use of this measure is mentioned and consequently no limiting value is reported in the literature. Using the concept of risk aversion it was proven that the most recently proposed ways to judge societal risk are all risk averse. The well known VROM-rule, that limits the FN-curve by 103/N 2 appears to be a special case of a more general rule proposed by Vrijling (1995), that limits the societal risk at the Dutch national level by: E(N) + k.c~(N) < 13.100.
Advances in Safety and Reliability: ESREL '97
51
The criticism of the VROM-rule, that the exponent of 2 is overly risk averse and that a value of 1 should be preferred, leads to a limitation of E(N) only. Limiting the FN-curve by C/N places an upperbound to E(N) and must be classified as a risk neutral approach. The risk integral RI, recently proposed by HSE as an alternative measure needing further investigation, is shown to be equal to 0.5 {E(N) 2 +(y(N)2}. Thus the risk integral should be classified as a risk averse measure of societal risk. The units [death2 /year] in which RI is expressed may hamper the understanding of this measure by the public. A linear expression like E(N) + k.o(N) with units [death/year] is preferred. In addition the relatively simple relation between this measure and a VROM-type of rule provides the possibility of unification. Attention should be paid to the fact that some rules (e.g. Vrijling(1995)) limit the societal risk at a national level, while most others (VROM,HSE) address the risk at plant level. Because "many small unrestrained developments could add up to a noticeable worsening of the overall situation" (HSE(1989)), the societal risk should be limited in a concerted way on both national and local level. In the approach of Vrijling (1995) the societal risk is limited at national level and consequently taking the number of hazardous installations into account a VROM-type of rule is derived for plant level.
LITERATURE Ale,B.,(1996), Zoning instruments for major accident prevention, Proc. ESREL/PSIAM, Crete, p. 1911. Bohnenblust,H.,(1996), Integrating technical analysis and public values in risk based decision making, Proc. ESREL/PSIAM, Crete, p. 1911. Cassidy,K.,(1996), Risk criteria for the siting of hazardous installations and the development in their vicinity, Proc. ESREL/PSIAM, Crete, p. 1892.
Deltacommittee (1960), Deltareport, Den Haag, The Netherlands. HSE,(1989), Risk criteria for land-use planning in the vicinity of major industrial hazards, HM Stationery Office. Institute of chemical engineering,(1985), Nomenclature for hazard and risk assessment in the process industries, ISBN 85 295184 1. VROM, (1988), Dutch National Environmental Plan, The Hague. VROM,(1992), Relating to risks (in Dutch), The Hague. Vrijling, J.K. et alt.,(1995), A Framework for risk evaluation, Journ. of Hazardous materials, 43, p.245-261. Wehr,H., Femaud,C., Bohnenblust,H.,(1995), Risk analysis and safety concept for new long railway tunnels in Austria, Proc. Safety in road and rail tunnels, Granada, p.3.
APPENDIX 1 (PROOF OF EQN 2)
0
Ox
O0
0
52
J.K. Vrijling and R H . A . J . M . van G e l d e r
APPENDIX 2 (PROOF OF EQN 10) cy 2 ( N ) = v a r N = E N 2 - E 2 N ,
So
E2N +~2N
= EN 2,
oo
x
oox
0
0
00
So 0
o
u
o
0 u
FROM RISK ANALYSIS TO RISK PERCEPTION: DEVELOPING A RISK C O M M U N I C A T I O N STRATEGY FOR A D A M - B R E A K FLOOD RISK M.L. Lima ~, A. Bet~mio de Almeida 2 and D. Silva 3 ~Dept of Organisational and Social Psychology, I.S.C.T.E., Av. For~:as Armadas, 1600 Lisboa; Portugal 2Dept of Hydraulics and Water Resources, I.S.T.,Technical University of Lisbon, Av. Rovisco Pais, 1600 Lisboa; Portugal 3 GES - Social Ecology Group, L.N.E.C., Av. do Brasil, 101, 1799 Lisboa Codex, Portugal
ABSTRACT
This paper describes the process of development of a risk communication strategy to implement the first structured flood warning system in Portugal in case of dam failure. This research project was funded through the NATO Science for Stability Program (NATO PO-FLOOD RISK Project). The pilot warning system was located along two sequential dams in Arade River (Algarve), which will enhance the safety of the population living in downstream valleys. The five phases of the process can be briefly described as: (a) Risk analysis and definition of inundation maps for different dam failure scenarios; (b) Descriptive analysis of human occupation of the risk area; (c) Exploratory analysis of expert and lay discourses about dam safety and risk; (d) Survey study on the public perception of dam related risk, and preventive behaviour against floods in general; (e) Definition of a communication strategy to establish a flood warning system.
KEYWORDS
risk perception, risk communication, inundation maps, population at risk, dam break, warning system
INTRODUCTION
The concept of environmental education has been used to refer to the strategies which aim at making people aware of environmental problems and at changing behaviour to alleviate them. However, within this general concept, only a specific type of environmental problems are usually considered: those that encourage environmentally responsible behaviour (such as conserving water and energy, recycling etc.). Preventive action to minimise the consequences of a natural or technological disaster is not often seen as a problem within this conceptual area. Instead, it has frequently been conceived as a technical problem in which structural and technology solutions are evaluated in terms of engineering criteria (Sime, 1995), and the population at risk is conceived as a mere target of a final design to a warning system. The different approach to both problems has important consequences in the way communication strategies are defined. While, in the first case, it is widely recognised that effective communication must take into account the needs, 53
54
M.L. Lima et al.
expectations, values and prior behaviour of the public, in the second case, communication is conceived only in from the experts" point of view. This technical approach systematically promotes low levels of information about the risk in the public in contrast to custodians of that information and, in case of disaster (for example a flood), the public in the impacted area is often not warned beforehand, although the flood has been detected or forecasted in advance (Handmer, 1988). In our research, and contrary to the above view of risk communication, we support an altemative approach which, as Sime (1996) puts it, considers the perspective of the public as a starting point in a warning system evaluation. Under this perspective, an effective warning system cannot be defined only in terms of the phenomena and the forecast, but also in terms of the involvement, characteristics and perceptions of those who are at danger (AEMI, 1995, Handmer, 1996; Syme, 1996, Sime, 1996). In this paper, we present the process of development of a risk communication strategy to implement the first structured flood warning system in case of dam failure in Portugal. This process was developed within a multidisciplinary integrated research project funded through the NATO Science for Stability Program, which aims at improving the safety of the population in downstream valleys. This project, entitled Dam-Break Flood Risk Management in Portugal (NATO PO-FLOOD RISK Project), integrates the results of contributions from hydraulic analysis, safety analysis, land-use management, social sciences and computer sciences (Almeida et al., 1996), and is supported also by the Portuguese water and dam safety authority (INAG), the main Portuguese power company (EDP) and the Portuguese Civil Protection Agency (SNPC). Until now, the construction of a risk communication strategy to implement the warning system involved five stages. The aim of the communication was to establish a pilot warning system for a set of two sequential dams in Arade River (Algarve), which will enhance the safety of the population living in downstream valleys. We will briefly describe the rationale and the accomplishments of each stage.
Stage 1- M a p p i n g the floodable area in case of a dam b r e a k event - Inundation maps
In this stage, several dam-break inundation studies were performed to determine the impact of a flood produced by a dam failure on the downstream area. Inundation maps were obtained for different dam failure scenarios, by numerical simulation based on computational models. According to Almeida & Viseu (1996), these types of floods are very different from ordinary natural floods for several reasons including: (1) a very high peak discharge and water depth valves; (2) eventual occurrence of movable bores and modular jumps; (3) fast and violent flooding of the banks; (4) flooding of previously dry land with abnormal dissipative effects; (5) transport of sediments and debris; (6) very difficult calibration of the models for each case. The production of inundation maps for our particular case was an important outcome of the project and a necessary step for risk assessment. From the different maps available, we decided to base our communication strategy in the worst case scenario: break of both Funcho and Arade Dams, and all inundated area was considered at risk, independently of the depth of the water.
Stage 2: D e s c r i b i n g the inundation area - D e m o g r a p h i c and land use characterisation in a GIS
In this stage, our goal was to produce information about the character&tics of the occupation of inundation areas in case of dam break, for that specific valley. To gather the information about the, the inundation map was compared with the census maps. Using this methodology, we could estimate the total population at risk (PAR) (and described its social and demographic characteristics) and the built environment in specific areas. In urban areas it was easy to have a very good overlap of the two maps. In rural areas, due to the dispersion of buildings, it was difficult to reproduce the flood maps in census maps. Downstream risk assessment must take into consideration several factors, including: (1) Warning time (WT), according to the literature (DeKay & McClelland, 1993; Brown & Graham, 1988) this variable is critical to predict loss of life in case of a dam break. The model differentiates between three cases in increasing vulnerability: WT4 levels' : V-test=-2,3 & V-test=2,3 for 'went down despite it was , capsized because nobody considered the possibility of the bow door 189
190
A. Tomter
remaining open upon departure, >went down due to a bow door hinge construction too weak to stand the rough weather, and >failed due to an unrecognised software inadequacy. One may in all these examples put the blame on human errors: not realising the iceberg threat (Titanic), a seaman taking a nap while on watch instead of closing the bow door (Herald of Free Enterprise), a construction engineer providing too weak hinge construction (Estonia), a system designer providing inadequate software (Ariane 5). And of course, the blame on human error is, literally speaking, correct, as it usually is in large accidents. But: the Titanic captain did probably not recognise icebergs to represent a significant hazard, the seaman on Herald of Free Enterprise did probably not envision the potential catastrophic consequences of taking a nap, the Estonia engineer was probably not aware of the construction weakness of the bow door hinge, and the Ariane 5 system designer did probabl}¢ not consider the possibility of a software inadequacy (the software was proved reliable in Ariane 4). Usually, when catastrophes result from human errors, the humans making the error were not aware of the occurrence of the fatal action (or lack of action), they were not aware of it' s inadequacy, or they did not realise the hazard potential at all. Human beings are not designed to perfection and infallibility. Human beings do make errors, and will continue to do so. Our ability to overview all details, interactions and behavioural patterns and modes of a large and complicated system is limited. Hence, all activities and processes where humans are involved, including all man-made systems, are exposed to unintended limitations, errors and deficiencies, and presence of such limitations, errors and deficiencies should be presumed.
THE CONCEPT OF VULNERABILITY The term Vulnerability has various meanings in literature, elg. Vulnerability to adverse conditions (Rosness 1991), Vulnerability () to malfunction because of component wearout (Meister 1991), Vulnerability (> to an external adversary system or situation (Meister 1991). u-- given the system characteristics, multiple and unexpected interactions of failures are inevitable. This is an expression of an integral characteristic of the system, not a statement offrequency. ~ (Perrow 1984) This statement introduces a different aspect of vulnerability, addressing the potential for malfunctions resulting from presence of unintended and unknown internal design deficiencies. Such deficiencies may be present from system due to human error during the design and/or production process. They may remain hidden for periods of time, and manifest themselves upon occurrence of some specific triggering conditions. The triggering condition may be fully ) and completely within the intended design envelope, and may be not adversary at all.
It is evident that this type of vulnerability may cause hazardous events which will not be identified, and which accordingly remain outside the scope of established safety analysis techniques and methodologies. A different approach for assessing the potential for such hazards in a system is needed. Such an approach has to rest upon some basic understanding of fundamental mechanisms causing hidden deficiencies as well as mechanisms for a deficiency to manifest itself and develop to a hazardous chain of events. When trying to develop such fundamental understanding, let us look to the human body. Although much may be and are said about the human race and human activity on earth, the human body is, when looked upon in a strict system context, a superb system demonstrating an amazing degree of adaptability, survivability and fault tolerance. Reason (1988) considers latent failures in an organisation analogous to the medical term of resident pathogens, which in combination with triggering factors bring about disease. His discussion was presented as a model of understanding failures within organisational and managerial systems. A corresponding discussion of the human body as a > operating within its environment may, however, be of good help in understanding corresponding mechanisms of technical systems.
Advances in Safety and Reliability: ESREL '97
191
The human body is continuously exposed to various strains and threats from a more or less hostile environment, e.g. hostile micro-organisms like bacteria and virus, which continuously try to intrude the body. Successful intrusion may cause disease. However, our body contains a sophisticated defence system, which counterattacks and tries to destroy the intruders. This immunity system is a major prerequisite for our survivability in a hostile environment. When we are healthy, this defence system succeeds in the continuos > and intruders are defeated. Occasionally, our body may be impaired or exposed to an extra strong attack, and our defence system needs to mobilise and activate all it's capabilities, and fight an intensive battle for some time. We experience this mobilisation and intensive battle as being sick. This model may, however, not explain the existence of chronic diseases. Chronic diseases are not a general condition affecting the entire population, but rather a specific condition striking certain individuals only. Hence, it seems logical to search for explanations of occurrence of a chronic desease in a disturbance or deficiency within the body of the individual affected (a >), either within internal physiological processes (i.e. >) or within the body's internal defence system. Such a fault may be present from birth, i.e. an integral characteristic of the > caused by a . The fault may, however, remain invisible as a hidden deficiency (i.e. as a predisposition to the associated disease), until some specific condition may trigger it's manifestation. The triggering condition may be quite normal and not represent any extraordinary level of strain or hostility at all, but happens to > the hidden deficiency leading to it's manifestation and outbreak of the associated disease symptoms. By applying this fundamental reasoning on technical systems, the potential for hazardous events may be considered as related to some kind of predisposition of systems to such phenomena. Such predisposition should be considered as a basic property of the individual system. This point of view raises two crucial questions: 1. What type of mechanisms or characteristics of a technical system may impact the likelihood and/or amount of hidden deficiencies residing in the system? What makes a system prone to such hidden deficiencies? 2. What type of mechanisms may be feasible to prevent a hidden deficiency to manifest itself as a hazardous event? How can defence mechanisms or a system-internal counteract the potential hazardous effect of hidden deficiencies in a technical system?
SYSTEM CHARACTERISTICS AND PRONENESS TO PRESENCE OF HIDDEN DEFICIENCIES Any man-made system is created through human processes of specification, design, production and implementation of the system. Unintended system deficiencies may be introduced through these processes, and may reside in the final system as an integral part of the system's total set of behavioural rules and patterns. Hidden deficiencies are unintended results from human activities, and may enter into and survive the entire system creation process due to fundamental limitations in human capabilities and capacities. When searching for system characteristics which may impact a system's proneness to hidden deficiencies, we should look for characteristics which have a bearing on fundamental human limitations. System characteristics increasing the level of mental capacity needed to maintain a complete and detailed perception and overview of all aspects of the system behaviour, are expected to increase the probability of unintended and hidden deficiencies to enter and survive the system creation process. System characteristics which tend to simplify the overall and detailed overview of all aspects of the system, are, on the other hand, expected to facilitate prevention, detection and elimination of such deficiencies within the system creation process. System characteristics should also be defined in a general context independent from the specific application or missions of the system. Hence, we should search for characteristics of the basic system structure as opposed to system functions. Based on Meister's (1991) structuring of systems in structural elements and
192
A. Tomter
Perrow's (1984) concept of complexity and coupling, 6 system characteristics are established as being expected to impact the probability of unintended system deficiencies to enter and survive the system creation process: 1) Complexity, 2) Coupling, 3) Size, 4) Differentiation, 5) Organisation, 6) Indeterminacy.
Complexity System complexity is dealt with in literature from various aspects and viewpoints: interdependency relationships among units and subsystems (Meister 1991), unfamiliar, unplanned, unexpected sequences which are invisible or difficult to comprehend, i.e. , (Perrow 1984), interconnections between parts and non-linear relationships between crucial variables (WahlstrOm 1990). It is reasonable to assume that a system with extensive dependencies, large number of parts, interconnections and relationships, and large amount of complex interactions, imposes a heavier challenge on the human mental capacity in establishing a complete comprehension of all aspects of the total system behavioural modes and parts, than does a system with limited dependencies, number of parts and interactions. This view is supported by Meister (1991) and Wahlstr6m (1990), who both claim that complexity makes the system more difficult to understand. Hence, the system characteristic Complexity is considered to have a major impact on a system's proneness to presence of hidden deficiencies.
Coupling. Coupling within a system focuses on how subsystems or parts are interconnected with each other. Perrow (1984) introduced the terms fight and loose coupling. Tight coupling is characterised by close and direct interconnections. The effect of an event occurring in a process state or part of a tightly coupled system tends to transmit through various parts of the system, and is more likely to cause a cascading effect. Loose coupling generally incorporate buffer capabilities between different stages in the process. The effect of an event occurring in a process state or part of a loosely coupled system is more likely to be absorbed within the system and causing limited impacts only. It is reasonable to assume that coupling is a relevant characteristic regarding proneness to accidents. The important effect seems, however, to rest on the capability to absorb and limit effects of occurring failures, thus acting as a defence mechanism counteracting potential hazardous effects of a hidden deficiency. Such defence mechanisms are further discussed below. Nevertheless, it seems also reasonable to assume that a tightly coupled system imposes a heavier challenge to the human mental capacity in maintaining an overall overview and comprehension of the system, than does a loosely coupled system. Hence, the system characteristic Cou01ing is considered to have some impact on a system's proneness to presence of hidden deficiencies.
Size Our intuitive way of characterising a system's size is by rather unprecise terms like small, medium, large, representing a perception of one system property. Whether the property is expressed as small, medium or large depends, however, on the specific reference frame. A >nuclear power plant may objectively be larger than a weapon control system. Despite this problem of taxonomy for measuring and expressing size as a system characteristic, size is yet a real property which needs to be addressd.
Advances in Safety and Reliability: ESREL '97
193
It seems obvious that large systems generally incorporate a higher number of subsystems and parts, as well as interrelationships, interconnections and interactions, than do smaller systems. Hence, large systems are assumed to be generally more demanding to the human mental capacity in maintaining an overall overview and comprehension of the entire system behavioural modes and patterns. This view is also supported by Meister (1991) and Wahlstrom (1990), who both considers size to be related to complexity. Hence, the system characteristic Size is considered to have a distinct impact on a system's proneness to presence of hidden deficiencies~
Differentiation Differentiation means ((the differences among units and subsystems within a single system.~ (Meister 1991). Hence, differentiation within a system depends on how the system is defined with respect to its boundaries, and what attributes of units and subsystems are addressed. For the purpose of assessing proneness of a system to hidden deficiencies, differences which may be relevant for the system designer's ability to completely overview and comprehend all interaction paths and relations within the system, should be taken into account. From this viewpoint the following aspects of of differentiation are considered relevant: 1) Mission of the subsystem, i.e. the prime function to be performed by the subsystem. 2) Operator involvement, i.e. unmanned, operator controlled, operator assessment/decision, execution task. 3) Degree of autonomy, i.e. ability to perform autonomously, or dependency on other subsystems. It is reasonable to assume a positive correlation between degree of differentiation between various subsystems and the need to co-ordinate their individual performance. It is further reasonable to assume that increased need for co-ordination tends to increase the mental capacity needed for maintaining a complete and detailed overview and comprehension of all behavioural paths and modes of the system as a whole. Thus, differentiation within a system is expected to be positively correlated with proneness to hidden deficiencies within the system. The strength of this correlation should, however, not be overemphasised, and related effect already accounted for, like complexity and size, should be excluded from this evaluation. Hence, the system characteristic Differentiation is considered to have some impact on a system' s proneness to presence of hidden deficiencies.
Organisation A system's or0ganisa.tion is the way in which units and subsystems are an-anged in relation to each other within the context of the total system. Some key aspects of a system organisation is rigidity versus flexibility, centralisation versus decentralisation, distribution of authority, and formality versus informality. In organisations characterised by rigidity, centralisation, authoritarianism and formality, performance is more directed by general or specific regulations and guidance originating at superior level, e.g. as operator procedures, special orders, etc. Flexible, decentralised and informal organisations are, on the other hand, more characterised by improvisation and more creative local level resolution of problems, as available and allowed range of response options are broader. A > type of organisation incorporates, as mentioned above, a more narrow set of response option. This will facilitate stability and predictability of overall system behaviour. Hence, it seems reasonable to assume that a > system generally enhance the ability to predict system behaviour and to maintain a complete and overall overview of all behavioural paths and modes of the system as a whole. This, in turn, is assumed to facilitate the ability to detect and eliminate system deficiencies within the system creating process.
194
A. Tomter
Hence, the system characteristic Or ganisation is considered to have a distinct impact on a system's proneness to presence of hidden deficiencies.
Indeterminacy Indeterminacy may be described as a function of various elements (Meister 1991): Input characteristics, need for interpretation of input, emphasis on information processing, required amount of decision making, procedural variability, and available response options. Indeterminacy is also considered to be closely related to uncertainty. The total uncertainty of a system may result from two different uncertainty components: 1) System uncertainty - a built-in system property, due to e.g. sensor limitation, procedural flexibility. 2) Situation uncertainty - reflecting uncontrollable impacts from the environment, e.g. enemy, weather. It seems reasonable to assume that design of indeterminate systems generally are more difficult and challenging for the designer than determinate systems. It is further reasonable to assume that built-in system uncertainties are associated with less predictability of system behaviour in given situation, and that this will tend to increase the system' s proneness to presence of hidden deficiencies. A corresponding reasoning may be applied to systems subject to situation uncertainties. Such systems should be designed for adequate response to various external situations. With dominant situation uncertainties, the overall sets of system responses and behaviour options will increase and be more complicated, and the potential for the system being exposed to situations to which it is not able to response adequately, will increase. Hence, the system characteristic Indeterminacy is considered to have an extensive impact on a system's proneness to presence of hidden deficiencies.
SYSTEM CHARACTERISTICS AS CAPABILITIES A hidden deficiency in a system will, when by a corresponding Iriggering condition, manifest itself as an unintended failure. This may, in turn, initiate an uncontrolled chain of events finally leading to an accident. The probability of this to occur is, however, dependant on the system's ability to counteract and prevent such hazardous development, i.e. the system's internal capabilities. The of a system is considered to consist of various safety defence mechanisms and barriers. These may be of two types: 1) General system properties which facilitate ability to tolerate local failures and absorb their effects within the system component concerned. Such ability is considered closely associated with resilience capabilities incorporated in the system. 2) Special protection strategies aiming at preventing and limiting hazardous effects of uncontrolled chains of events. Such strategies should be developed based on a well recognised accident development model.
System resilience - the key to general .hazard immunitp~ capabilities The discussion of resilience as a key to hazard immunity of a system is mainly based on Foster (1993). He states the need for giving resilience greater attention in decisionmaking processes and systems in general (i.e. social, political, economical, ecological, biological as well as technical systems). While resilience generally is consider to incorporate a broad set of dimensions, three dimensions are considered to be most relevant for technical systems: System, Operational and Physical characteristics. Resilience related to the System dimension is impacted by the following characteristics:
Advances in Safety and Reliability: ESREL '97
195
1) Dependency on external variables. Heavy dependency on external and uncontrollable variables reduces the degree of resilience, while acceptance of extensive ranges of external variables provides greater ability to accept uncontrolled and unperfected fluctuation of values. 2) Diversity versus specialisation. A highly specialised system may provide higher productivity and output rate, but is more adapted to those specific conditions which it is designed for. Significant deviations of the conditions may for a highly specialised system provide serious common-cause failures, while systems of high diversity more easily will tolerate such deviations and isolate their effects. 3) Functional redundancy. It is obvious that functional redundancy enhances the system's ability to continue it's performance in failure situations, thus preventing system collapses and related accidents. Resilience related to the Operational dimension is impacted by the following characteristics: 1) Reversibility. As results of decisions usually are impacted by uncertain or unrecognised conditions, it is reasonable to consider increased reversibility of processes to enhance system resilience and ability to tolerate failures and counteract adversary effects. 2) b~cremental application of resources. This implies that reduced system capability, e.g. caused by breakdown of certain system components, is able to continue a reduced set of operational functions (degraded operations). It is reasonable to consider this option of responding to a failure situation as an important mechanism for preventing serious system collapses and accidents. 3) Hierarchical embedding. This implies the capability of individual subsystems to continue their operations in an autonomous mode in a situation of failure of other parts of the. It's contribution to system resilience and corresponding ability to prevent serious system collapses and accidents, are strongly similar to incremental application of resources discussed above. Resilience related to the Physica ! dimension is impacted by the following characteristics: 1) Cellular structure. Cellular structure is heavily employed in nature, combined with ability of cells to divide and replace lost cells. This concept of nature constitutes a superior recuperative ability, as other cells can take over functions from lost cells while new cells are created to replace the lost ones. It is obvious that such structure provides for extensive resilience and increased system survivability. 2) Mobility. Mobility is highly used in nature as survival strategy. In military strategy, the importance of mobility for increased resilience and survivability is well accepted. Technical systems may also benefit from mobility in order to avoid unexpected and adverse external strains and threats. 3) uLoose coupling~. This term was introduced by Perrow (1984) and focuses on how subsystems or parts are interconnected within the system (ref. discussion above). A ~doosely coupled)) system tends to incorporate buffer capabilities between various stages in the system process, thus increasing the ability to locally absorb adverse effects of failures and prevent an uncontrolled cascading development.
Accident
prevention
strategies
- specialised
hazard
protection
mechanisms
The general energy model explains an accident to be caused by uncontrolled release of energy, while injuries to personnel are caused by transfer of energy in excess of body injury thresholds. From this basic model Haddon (1989) developed a number of accident prevention strategies within three groups, focusing on Energy source, Barriers and Victim.
Strategies related to energy source includes the following: - prevent build-up of energy - modify the characteristics of energy - limit the amount of energy - prevent uncontrolled release of energy - modify rate and concentration of released energy. These strategies aim at eliminating or reducing the amount of energy subject to potential uncontrolled release, and corresponding potential for damages or injuries in situations of system failures. This group of strategies involve basically the system itself and associated operations.
196
A. Tomter
Strategies related to barriers include the following: separate the source of energy and potential victims in time or space (e.g. safety zones, time slots) separate by means of physical barriers (e.g. protection covers, fences) These strategies aim at preventing potential victims to be in the proximity if and when energy might be released, thus preventing personnel to experience injuries. This group of strategies involve not only the system, but related safety organisation, procedures and measures as well. -
-
Strategies related to the victim include the following: - improve the victims ability to endure an energy flow (e.g. safety glasses, gloves, boots, etc.) limit the development of injury (e.g. rescue and first aid organisation, assets and capability) stabilise, repair and rehabilitate (e.g. medical treatment, hospital capabilities) These strategies aim at limiting the injuries if an accident, despite the and safety defence mechanisms incorporated in the system, yet does occur. This group of strategies involve not only the system and related organisation, procedures and safety assets, but also the general public infrastructure regarding rescue and health services and capabilities. -
-
CONCLUSIONS Conventional safety analysis techniques and methodologies do not address for safety hazards of a system caused by unintended and hidden system deficiencies. The approach presented in this paper addresses just this type of safety hazards in technical systems. The approach is resulting from a theoretical and logical deduction process, based on the author's viewpoints regarding general human fallibility, basic limitations of human mental capabilities, and technical systems as products of human processes. Although the approach as part of the deduction process was tested on a specific system, it is, however, not backed by any experience. The author acknowledges that the approach needs critical discussions, evaluations and further refinements, as well as systematic testing, verification and validation activities, before any adequacy and validity as a practical tool may be claimed. It is the author's hope that this will be considered an interesting challenge by the system safety research environment.
REFERENCES Foster, Harold D (1993). Resilience Theory and System Evaluation. NATO AS1 (Advanced Science Institutes) Series F." Computer and Systems Sciences, Vol. 110 (Verification and Validation of Complex Systems: Human Factors Issues), 35-61. Haddon, W. (1980). The basic strategies for reducing damage from hazards of all kinds. Meister, David (1991). Psychology of System Design. Elsevier, New York. Perrow, Charles (1984). Normal Accidents. Living with high-risk Technologies. Basic books, New York. Reason, James (1988). Resident Pathogens and Risk Management.. Paper given to First World Bank Workshop on Safety Control and Risk Management, Washington DC. Rosness, Ragnar (1991). Vulnerability m Complex Systems- Directions for Research. Paper presented at NTNU Continuing Education Course in Safety Management, Trondheim 1993. WahlstrOm, Bjrm (1990). Vulnerability, environmental accidents and communication. Invited paper presented on the 9th Nordic Conference for Accident Researchers - NOFS90, Svalbard 1990.
A8" Expert Judgement in Safety Assessments
This Page Intentionally Left Blank
KEEJAM: A KNOWLEDGE ENGINEERING METHODOLOGY FOR EXPERT JUDGMENT ACQUISITION AND MODELING IN PROBABILISTIC SAFETY ASSESSMENT G. Cojazzi, G. Guida*, L. Pinola, R. Sardella °, P. Baroni* European Commission, Joint Research Centre, Ispra, ISIS, Italy *Universit~ degli Studi di Brescia, DEA, Brescia, Italy °Universit/t degli Studi di Bologna, DIEM, Bologna, Italy
ABSTRACT In this paper a novel expert judgment methodology, called KEEJAM (Knowledge Engineering Expert Judgment Acquisition and Modeling), which is supposed to be applicable to a variety of expert judgment elicitation contexts, is described. The KEEJAM methodology takes in input the definition of the application domain of interest and the specification of the expert judgment tasks to be faced. This approach provides structured and disciplined support to the normative expert, namely the knowledge engineer, in eliciting the knowledge and the reasoning strategies of the experts, building consistent knowledge models, and applying such models to the solution of the expert judgment tasks considered. The KEEJAM methodology is organized into five phases: start-up, design, knowledge acquisition and modeling, exploitation and refinement, synthesis and release. The main features of each phase are described in the paper, and practical suggestions for tailoring the KEEJAM methodology in concrete cases are provided. The KEEJAM methodology is currently being applied in the framework of a European Benchmark Exercise on Expert Judgment Techniques in PSA level 2 (Cojazzi et al., 1996).
KEYWORDS
Probabilistic Safety Assessment, Expert Judgment, Knowledge Engineering, Knowledge Acquisition and Modeling.
INTRODUCTION
Among the primary objectives of Probabilistic Safety Assessment (PSA) of complex industrial systems, such as nuclear power plants, there is the representation of the overall risks related to their existence and operation. Due to the complexity of the systems under analysis, a large amount of information is inevitably involved. Different types of knowledge sources must be considered and integrated to obtain a global assessment, and the inherent uncertainty that affects the conclusions reached must be correctly quantified. Expert Judgment is generally needed to identify, interpret and process the available information and the related uncertainty. As a matter of fact, structured expert judgment, substantiated by adequate rationales, is required and accepted as major source of information when: 199
200
G. Cojazzi et al.
• no experimental data or sufficiently validated computer codes are available for predicting the occurrence and the evolution of the phenomena of interest (incomplete knowledge of the governing phenomena); • the interpretation of available data or the applicability or the validity of current models and codes are questioned. In such cases, expert judgment use is one of the most critical tasks within the overall safety assessment process, and EJ methods must allow expert judgment to be included in an auditable fashion (IAEA, 1994). In fact, the credibility of the overall assessment heavily depends on the traceability, scrutability and accountability of the expert judgment process and, therefore, specific methodologies for formal and structured expert judgment have been designed and applied (USNRC, 1990), (Cooke, 1991), (Mosleh and Apostolakis, 1984), (Kaplan, 1992), (Sandri, 1991), (Pulkkinen, 1994). Since the pioneering work performed for the completion of the NUREG 1150 study (USNRC, 1990), structured expert judgment has been proposed and used in a variety of studies spanning from waste repository studies (Bonano et al., 1990) to probabilistic consequence analysis (Harper et al., 1995). Notwithstanding the success gained by those EJ applications, the analysis of the characteristics of EJ in the PSA domain has suggested the possibility of a completely different approach to structured expert judgment, takifig advantage of methods and techniques developed in the field of knowledge engineering. In order to properly design a new methodology, a set of requirements for a knowledge-based approach to EJ acquisition were firstly developed in (Guida et al., 1996). Starting from that initial work, this paper describes a first version the Knowledge Engineering Expert Judgment Acquisition and Modeling (KEEJAM) methodology for structured expert judgment in PSA. The paper is organized as follows. Section 2 presents the motivations underlying the proposed approach and section 3 discusses the main objectives pursued. Section 4 introduces the basic definition of KEEJAM, while the detailed organization of the methodology into phases and tasks is presented and commented in section 5. Some concluding remarks are given in section 6.
MOTIVATIONS The perspective of the proposed EJ methodology is that expert judgment is a knowledge problem, and, hence, a correct treatment of the expert judgment issue should consider in detail the knowledge the experts base their judgments upon. The focus of attention is thus shifted from the final numerical opinions of the experts back to the knowledge, the hypotheses, the data, and the assumptions the experts employ to formulate their judgments. Considering the expert judgment a knowledge problem implies that, first of all, the experts' knowledge and problem-solving strategies applied to solve the problem at hand are acquired. Then, in order to exploit this knowledge, it is necessary to formalise the different problem-solving approaches proposed by the experts and build up self-consistent models. These resulting knowledge models constitute an explicit representation of the state of the art in the field of interest, which is made available to the user in a scientifically communicable, correctable and updatable form. Then, by means of an analysis of the knowledge models, the root causes of the differences in the experts' final numerical estimates can be identified. The differences due to misunderstandings or trivial calculation errors can be solved, and experts' consensus can be reached; otherwise, it is possible to distinguish between actual disagreements and simply alternative points of view. Hence, the aggregation of the different experts' opinions can be made by means of an integration of the different data and reasoning mechanisms exploited by the experts, according to the analysis of their alternative points of view and actual semantics. The analysis of the knowledge models supports also the identification of the various forms of imperfections (imprecision, vagueness, uncertainty, etc.) that characterise the knowledge itself. As a consequence, it is
Advances in Safety and Reliability: ESREL '97
201
possible to justify the selection of a suitable formalism for uncertainty representation in the specific case at hand, according to the characteristics of the domain, and avoiding any a-priori superimposition of a particular uncertainty formalism. Some of the main high-level objectives of the Knowledge Engineering Expert Judgment Acquisition and Modeling (KEEJAM) methdology are hereafter reported.
Modeling of the knowledge behind expert judgments. KEEJAM focuses not only on the numerical experts' judgments elicitation and combination, but provides an explicit and formal representation of the knowledge and of the reasoning processes the experts use to derive such results. How the experts reason, the methods they use to solve the problem under study, the assumptions and decisions they make, the knowledge they exploit in their reasoning and all relevant justifications are acquired and formalised in executable knowledge models. Representation of uncertainty. Starting from the analysis of the explicited and formalised knowledge models, KEEJAM aims at identifying, on a case-by-case approach, a representation for uncertainty which is justified by the specific characteristics of the domain knowledge at hand. The uncertainty representation should be cognitively plausible, i.e., it should respect the actual semantics as intended by the domain experts.
Justification. KEEJAM aims at providing deep justifications of the results achieved, both from the normative and the substantive points of view. The deep reasons that motivate and justify (both technically and legally) the results obtained are brought to light, and the models and the assumptions that are behind the achievement of a given result are explicited in detail. Moreover, justifications are used to support a critical comparison and integration of the results obtained from the different experts.
Integration of knowledge sources. KEEJAM aims at expliciting the reasons that are behind the different experts' results; they may depend on a variety of different reasons (use of different codes, different inputs, etc.). Resorting to the analysis of these reasons permits resorting to more structured compositions than mere numerical treatment of the different judgments.
Scrutability and maintenability. KEEJAM provides explicit and formal (executable) models of the experts' problem solving, leading to a deep scrutability of the results and to the possibility of ease maintenance and updating of the models themselves. Knowledge engineering can offer the suitable techniques for eliciting and modeling the experts' knowledge; an introduction to knowledge acquisition and modeling techniques can be found in: (Barr and Feigenbaum, 1981), (Kidd, 1987), (Greenwell, 1988), (Diaper, 1989), (Boose, 1990), (Scott and Clayton, 1991), (Ford and Bradshaw, 1993). In synthesis, the proposed new methodology of structured and formal expert judgment process, based on a knowledge engineering approach, aims at achieving two fundamental objectives: o developing explicit and formal models of expert knowledge and reasoning that can be employed to reproduce the results of expert judgment in a mechanical way, through a transparent and justified process; o modeling the domain knowledge uncertainties with the aim of obtaining an effective uncertainty representation, cognitively plausible and, above all, justifiable from the substantive point of view.
BASIC CONCEPTS AND PHASES DEFINITION
The methodology KEEJAM is structured into phases and tasks. The methodology is defined in general terms in order to be applicable to a variety of expert judgment acquisition contexts. Therefore, KEEJAM explicitly includes a preliminary phase (Phase 1, see later) devoted to the verification of the prerequisites for applicability and to the tailoring to the specific case considered. The KEEJAM methodology is globally aimed at developing conceptual models of expert knowledge and reasoning in the application domain of
G. Cojazzi et al.
202
interest. A conceptual model is an explicit representation of the knowledge relevant to the application domain, and of the ways this knowledge is used to solve the class of problems of interest (Hayes-Roth et al., 1983), (Guida and Tasso, 1994). The KEEJAM methodology includes five phases: • Phase 1: Start-up is devoted to a preliminary analysis of the application domain, to verify the feasibility and appropriateness of the knowledge-based approach, to define the requirements of the knowledge and reasoning models to be developed, to tailor the methodology to the case at hand, to define the project team, and to plan the methodology application. • Phase 2: Design is aimed at defining appropriate techniques for the representation of the types of knowledge and reasoning strategies relevant to the application domain of interest, also including the treatment of the imperfections that may affect knowledge and reasoning. • Phase 3: Knowledge acquisition and modeling is devoted to acquiring knowledge from the identified knowledge sources (domain experts, written documents and real-world contexts) and at developing a domain conceptual model that meets the stated requirements. • Phase 4: Exploitation and refinement is devoted to exploit the conceptual model developed for carrying out the assigned set of expert judgment tasks. • Phase 5: Synthesis and release collects the results obtained and produces a suitable documentation of the work done. In addition, KEEJAM structuring allows also the implementation of quality control and assurance processes.
M E T H O D O L O G Y ORGANIZATION The basic organization of KEEJAM into phases and tasks is reported below. This structure should be considered as a reference framework. INPUT
definition of the application domain definition of the expert judgment tasks
11. START-UP 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10
familiarization with the application domain and domain experts preliminary analysis of the application domain through interview of domain experts assessment of the feasibility and appropriateness of aknowledge engineering approach definition of conceptual modeling requirements selection of knowledge sources definition of documentation standards definition of quality control and assurance processes definition of project team tailoring of the methodology work planning
OUTPUT feasibility assessment conceptual modeling requirements knowledge sources documentation standards quality control and assurance processes project team tailored methodology work plan 2. DESIGN
2.1 2.2
domain analysis and design/choice of techniques for representing knowledge and reasoning analysis of the various forms of imperfection that affect knowledge and reasoning and design/choice of techniques for uncertainty representation and processing
Advances in Safety and Reliability: ESREL '97 2.3 2.4 2.5
203
design/choice of suitable conceptual modeling languages testing of the selected conceptual modeling languages with domain experts and refinement definition of specific requirements for knowledge acquisition and modeling
OUTPUT basic technical choices conceptual modeling languages and knowledge acquisition and modeling requirements 3. KNOWLEDGE ACQUISITION AND MODELING 3.1 knowledge acquisition planning 3.2 knowledge acquisition and modeling repeat o knowledge elicitation from knowledge sources o knowledge modeling and representation o knowledge integration o knowledge validation and refinement with domain experts unt____iithe l conceptual model meets the stated requirements 3.3 refinement and validation of conceptual model with domain experts IOUTPUT conceptual model 4. EXPLOITATION AND REFINEMENT for each expert judgment task 4.1 task execution and expert judgment formulation 4.2 development of justifications 4.3 critical analysis with domain experts 4.4 final model refinement and validation with domain experts 4.5 result collection and documentation OUTPUT expert judgment formulation for the tasks considered and justification 5. SYNTHESIS AND RELEASE 5.1 documentation collection and organization 5.2 quality records collection and synthesis critical analysis of the work done 5.3 5.4 writing of the final technical report OUTPUT complete documentation quality certification The following remarks provide some comments and notes for a better and more concrete understanding of the KEEJAM methodology defined above. Phase 1 (Start-up) is devoted to define detailed technical bases for the expert judgment acquisition project. Task 1.2 (Preliminary analysis of the application domain through interview of domain experts) focuses on: o analysis of the domain knowledge; o analysis of the expert judgment tasks considered; o analysis of the problem-solving strategies adopted by the experts. Task 1.3 (Assessment of the feasibility and appropriateness of a knowledge engineering approach) aims at assessing if the application domain can be considered knowledge intensive, i.e., the domain experts rely on large and different knowledge sets, and if a structured collection of domain knowledge and problem-solving strategies is of actual interest for the final EJ user.
204
G. Cojazzi et al.
Task 1.4 (Definition of conceptual modeling requirements) considers the basic conceptual modeling requirements, such as the purpose, the scope, the suitable granularity of the model and the knowledge epistemological types, and the requirements of the language to be used for the formalization of the conceptual model. Task 1.5 (Selection of knowledge sources) aims at identifying the knowledge sources to be exploited in the project, namely: domain experts, written documents, and real-world contexts (Guida and Tasso, 1994). The analysis of the available knowledge sources takes into account the following main attributes: o quality and cost of a knowledge source; o coverage, with respect to the application domain considered; o necessity of the knowledge source in order to provide essential domain or problem-solving knowledge; o availability, especially important for domain experts. Then selection aims at: o covering all parts and facets of the application domain; o ensuring an adequate quality of the elicited knowledge; o minimizing knowledge acquisition costs (effort and time); o ensuring a smooth and effective knowledge acquisition process through a sufficient level of availability of the selected knowledge sources and a limited degree of redundancy. Task 1.8 (Definition of the project team) defines completely the project team, the role of each team member, his function and the expected engagement in the project. Task 1.10 (Work planning) focuses on the scheduling of phases and tasks, the definition of intermediate results, the responsibilities, the mile-stones and the control actions, including possible re-planning. Phase 2 (Design) deals with the basic design choices that will drive the subsequent activities of knowledge acquisition and conceptual modeling. Task 2.3 (Design~choiceof suitable conceptual modeling languages) aims at defining specific representation languages appropriate for the application domain considered (Barr and Feigenbaum, 1981). It should rely as much as possible on previous proposals and experience, in such a way as to support standard and reuse. Phase 3 (Knowledge acquisition and modeling) is aimed at building a conceptual model of the application domain of interest, encompassing both domain and problem-solving knowledge. The conceptual model developed may be constitued by paper models or a computer-based models, according to the characteristics of the case at hand and to the user needs envisaged. Task 3.1 (Knowledge acquisition planning) aims at defining the knowledge acquisition plan, containing a precise specification of all activities relevant to the knowledge acquisition task, their logical organization, and their temporal scheduling. Each knowledge acquisition activity is identified by the following information: o goal to be attained: knowledge elicitation, modeling, representation, integration, refinement, validation; o scope: specific topics to be considered; o involved knowledge source; o knowledge elicitation technique to be used; o supporting materials to be exploited; o scheduled date and place of execution of the knowledge acquisition activity. Generally, a knowledge acquisition activity has one goal, it involves one knowledge source, and it uses one elicitation technique. Composite knowledge acquisition activities involving more goals, knowledge sources and elicitation techniques are always intricate and rarely effective. General criteria to be taken into account in the design of a knowledge acquisition plan include: alternating knowledge acquisition activities with different goals and different knowledge acquisition techniques, and allocating enough time between
Advances in Safety and Reliability: ESREL '97
205
knowledge acquisition activities in order to achieve a deep understanding of the knowledge acquired and to permit a critical analysis of the representations produced. Task 3.1 may also refine, if appropriate, the selection of knowledge sources carried out in Task 1.5. Task 3.2 (Knowledge acquisition and modeling) is the core step of Phase 3 and of the whole KEEJAM methodology. It is of primary importance that the knowledge engineers in charge of it master.a sufficiently large set of knowledge acquisition techniques - see (Kidd, 1987), (Greenwell, 1988), (Diaper, 1989), (Scott and Clayton, 1991), (Firley and Hellens, 1991), (Ford and Bradshaw, 1993). Phase 4 (Exploitation and refinement) concems the execution of the conceptual model to derive expert judgment results. The execution may be manual if the conceptual model is composed by paper-executable models, sufficiently simple and small, or computer-supported if the knowledge models are computer-based, large and complex. Task 4.2 (Development of justifications) is a fundamental step of Phase 4. In fact, one of the main reasons for a knowledge-based approach to expert judgment is having clear and well founded justifications of the results obtained. Justifications are an essential component of problem solving based on a knowledge-level model. In the expert judgment process, these justifications represent a crucial quality factor; they are the basis for assuring some very important properties of the results obtained, such as coherence, verifiability and scientific defensibility. Task 4.4 (Model refinement and validation with domain experts) is also an important step of Phase 4. In fact, when models are put to work, many adjustments and refinements may emerge, which can significantly improve the applicability of the conceptual model to the considered cases and the quality of the results. Of course, any modification and extension of the models should be discussed with domain experts. Phase 5 (Synthesis and release) aims at carrying out a final critical analysis of the obtained results, paying a particular attention to quality issues. The final project documentation is produced as well.
CONCLUSIONS In this paper a first high-level definition of KEEJAM, a Knowledge Engineering methodology for Expert Judgment Acquisition and Modeling in PSA, has been presented. Differently from other methodologies, KEEJAM focuses on the acquisition and modeling of the knowledge underlying the formulation of the judgment provided by the experts. In fact, in our opinion, only resorting to explicit knowledge and reasoning models, it is possible to assure such fundamental properties as validity, transparency and justification of the results of the whole EJ process. Expected benefits deriving from the application of the KEEJAM methodology include: o explicit and formal modeling of the knowledge and reasoning on which expert judgments are based; o cognitively plausible and substantively justified representation of knowledge imperfections; o possibility of aggregating the opinions of the experts by integrating several, different knowledge sources (domain experts, written documents, real-world contexts) into a unitary and consistent conceptual model; o possibility of incremental refinement of the models developed; o justification of expert judgment results, in terms of both the knowledge and the reasoning strategies used to derive them. On the other hand, some weak points are foreseen: o KEEJAM application is expected to be rather complex and costly, requiring substantial effort and long time; o KEEJAM requires as a fundamental resource the availability of recognized domain experts, actually available to cooperate for long time periods and capable of carrying out a hard introspective work with
206
G. Cojazzi et al.
the knowledge engineer; the cooperation of domain experts is a key point for the success of a knowledge engineering project, and, in some cases, it may be difficult to obtain, thus constituting a possible bottleneck. The KEEJAM methodology is currently being applied in the framework of a European Benchmark Exercise on Expert Judgment Techniques in PSA level 2 (Cojazzi et al., 1996). The application of the methodology to this case and the evaluation of the results will be the subject of future works.
REFERENCES
Barr, A., and Feigenbaum E. A., (1981). The Handbook of Artificial Intelligence, Kaufman, Los Altos, California, USA, 141-222. Bonano, E.J., Hora, S.C., Keeney, R.L. and von Winterfeldt, D., (1990). Elicitation and Use of Expert Judgment in Performance Assessment for High-Level Radioactive Waste Repositories, United States Nuclear Regulatory Commission, NUREG/CR 5411, Washington DC, USA. Boose, J.H. and Gaines, B.R., (Eds.), (1990). The Foundations of Knowledge Acquisition - KnowledgeBased Systems, Vol. 4, Academic Press, London, UK. Cojazzi, G., Pinola, L. and Sardella, R., (1996). The JRC Ispra Benchmark Exercise on Expert Judgment Techniques in PSA level 2: Design Criteria and General Framework, Proc. of Int. Topical Meeting on Probabilistic Safety Assessment (PSA '96), Sep. 29- Oct. 3, 1996, Park City, Utah, US. Cooke, R. M., (1991). Experts in Uncertainty, Oxford University Press, New York. Diaper D. (ed.), (1989). Knowledge Elicitation: Principles, Techniques and Applications, Ellis Horwood, Chichester, UK. Guida, G., Baroni, G., Cojazzi, G., Pinola, L. and Sardella, R., (1996). Preliminary Requirements for a Knowledge Engineering approach to Expert Judgment Elicitation in Probabilistic Safety Assessment, in P.C Cacciabue I.A. Papazoglou (Eds.), Proc. of ESREL '96 -PSAM III International Conference on Probabilistic Safety Assessment and Management, Crete, Greece, 1996, Springer-Verlag London, UK. Guida, G. and Tasso, C., (1994). Design and Development of Knowledge-Based Systems: From Life Cycle to methodology. John Wiley & Sons, Chichester, UK. Firley, M. and Hellens, M., (1991). Knowledge Elicitation - A Practical Handbook, Prentice-Hall, London, UK. Ford, K., and Bradshaw, J.M. (Eds.), (1993). Knowledge Acquisition as Modeling, John Wiley & Sons, Chichester, UK. Greenwell, M., (1988). Knowledge Engineering for Expert Systems, Ellis Horwood, Chichester, UK. Harper, F.T., Hora, S.C., Young, M.L., Miller L.A., Lui, C.H., McKay, M.D., Helton, J.C., Goossens, L.H.J., Cooke, R.M., Pasler-Sauer, J., Kraan, B. and Jones, J.A., (1995). Probabilistic Accident consequence Uncertainty Analysis. Dispersion and Deposition Uncertainty Assessment. Main Report, US NRC, NUREG/CR-6244, EC EUR 15855EN, SAND94-1453. Hayes-Roth, F., Waterman D., and Lenat D., (1983). Building Expert Systems, Addison-Wesley, Reading, Massachusetts, USA. IAEA, (1994). Procedures for Conducting Probabilistic Safety Assessments of Nuclear Power Plants (Level 2), International Atomic Energy Agency, Safety Series No. 50-P-8, Vienna, Austria. Kaplan, S., (1992). 'Expert information' versus 'expert opinions'. Another approach to the problem of eliciting/combining/using expert knowledge in PRA, Rel. Engng. and System Safety, 35, 61-72. Kidd, A., (Ed.), (1987). Knowledge Acquisition for Expert Systems, A Practical Handbook, Plenum Press, New York. Mosleh, A., Apostolakis, G., (1984). Models for the Use of Expert Opinions, in Low-Probability~HighConsequence Risk Analysis: Issues, Methods, and Case Studies, R. A. Waller, V. T. Covello (eds.), Plenum Press, New York. Pulkkinen, U., (1994). Statistical Models for Expert Judgment and Wear Prediction, VTT publications 181. Technical research centre of Finland, Espoo 65 p. + app. 80 p.
Advances in Safety and Reliability: ESREL '97
207
Sandri, S., (1991). La Combinaison de l'Information Incertaine et ses Aspects Algorithmiques, Th6se pr6sent6e/~ l'Universit6 Paul Sabatier, Toulouse, France. Scott, A.C. and Clayton, J.E., (1991). A Practical Guide to Knowledge Acquisition, Addison-Wesley, Reading, MA. USNRC (1990). Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, United States Nuclear Regulatory Commission, NUREG-1150, Vol 1, Washington DC, USA.
This Page Intentionally Left Blank
A PRACTICAL CASE OF ASSESSING SUBJECTIVE P R O B A B I L I T I E S A DISCUSSION OF CONCEPTS AND EVALUATION OF METHODS L. Berg Andersen 1, T. Nilsen z, T. Aven 3, A. Guerneri 4 and R. Maglione 4 1 Well Service Technology A/S, P.O. Box 61,5061 Kokstad, Bergen, Norway 2 RF-Rogaland Research, Stavanger, Norway 3 Stavanger University College, Stavanger, Norway 4 Agip SpA, Milan, Italy
ABSTRACT
The main objectives of this paper are to present and discuss project experiences concerning a subjective probability assessment process and thus, contribute to a sound basis for future quantitative risk analysis (QRA) in a full Bayesian setting. The paper clarifies some of the most important basic concepts and describes factors that significantly affect the credibility of the expert evaluations. Problems and solutions related to alternative ways of transferring the expert-information to figures are discussed on the basis of practical cases of assessing subjective probabilities. These cases demonstrated the possibility and the potential of using experts for assigning probabilities an thus transfer knowledge into probability values. However, some well known problems associated with assigning subjective probabilities were recognised, i.e. superficiality and lack of precision. The problem of imprecision increased significantly when evaluating events associated with the lower part of the probability scale. Our experiences suggest that the main causes of superficiality and lack of precision were related to the expert's difficulties in expressing his degree of belief to small figures, lack of training in assigning probabilities, and problems in maintaining the experts motivation.
KEY WORDS
Subjective probability, uncertainty, probability assessment, risk analysis, decision making, blowout risk, expert judgement.
INTRODUCTION
This paper is based on the experiences gained through the R&D project ~<Stochastic Modelling for the Quantification of Kick and Blowout Risk During Exploration Drilling>>, (Berg Andersen and Aven, 1996). The project aims to develop a computerised risk management tool that strengthen the basis for decision making regarding well control problems in the planning phase of new exploratory wells.
Well specific parameters must be considered on a fairly detailed level in order to establish risk models that support the management's decision making in the planning of new exploration wells. Consequently, the 209
210
L.B. Andersen et al.
complexity of the risk model increases and the available amount of hard data for assessing coherences and probabilities decreases. Berg Andersen and Pedersen (1996) concluded that a subjectivistic probability model should be adopted when modelling for the quantification of well specific risks related to the kick phenomenon (uncontrolled flow of hydrocarbon from the formation to the wellbore). Systematised drilling experience in terms of available hard data and expert judgements were to be combined in a full Bayesian setting. The model conclusions are expressed by a well specific kick probability and interpreted as .
Objectives and Scope of Work The main objectives of this paper are to present and discuss project experiences concerning a subjective probability assessment process and thus, contribute to a sound basis for future quantitative risk analysis (QRA) in a full Bayesian setting. Major challenges recognised when applying a subjective probability model in a QRA are unclear definitions of basic concepts, understanding factors affecting the credibility of the expert judgements, and the lack of proper probability assessment methods. This paper seek to clarify some of the most important basic concepts and describe factors that significantly affect the credibility of the expert evaluations. Finally, problems and solutions related to alternative ways of transferring the expert-information into figures are discussed on the basis of practical cases of assessing subjective probabilities.
BASIC CONCEPTS
Probability and Frequency Let: A - the occurrence of an accidental event X = the number of accidental events occurring In the classical approach we assume that there exist values p and m such that p equals the true probability of A and m equals the expected value (frequency) of the random variable X, i.e. p=P(A) and m=EX. The probability p represents the relative fraction of times the event A occurs if the situation analysed were hypothetically repeated an infinite number of times. The expected value m represents the mean number of X if the situation analysed were hypothetically repeated an infinite number of times. The true values p and m are objective but unknown characteristics of the event A and the quantity X, respectively. Thus these unobservable parameters are to be estimated in the risk analysis, using models like fault trees and event trees. In the classical approach the uncertainty notation is related to the accuracy of the estimated quantities p and m, i.e. the gap between the unobservable assumed true value and the estimate generated by the risk analysis.
A subjective probability represents a degree of belief. In the Bayesian approach we use the probability notion to express the uncertainty related to the values of observable quantities such as A and X. Hence, in a full Bayesian setting the meaning of uncertainty is completely different from what we mean by uncertainty in the Classical model. What is uncertain is the occurrence of the event A and the value of X, and the probabilities P(A) and P(X =x) express this uncertainty. In a full Bayesian setting there is no sense in speaking about uncertainty of the probability P, because such a reasoning would presuppose the existence of a true value of P.
Advances in Safety and Reliability: ESREL '97
211
Expert Judgements Judgements are inferences or evaluations that go beyond obvious statements of fact, data, or the conventions of a discipline. Factual judgements are beliefs or opinions about propositions that can, in principle, be proven to be right or wrong. Value judgements are expressions of preferences among alternatives based on tradeoffs and priorities. Because values are inherently personal, value judgements cannot be proven right or wrong. Most real judgements mix factual and value elements, (Otway and von Winterfeldt, 1992).
Many judgements require a special type of expertise. Making inferences about parameters and assigning probabilities to events must be based on special knowledge of the technical system, of data and model results, and of the parameters and events relevant to the analysis. We call any judgement requiring special expertise an >. Expert judgements can be the result of either informal or formal processes. Informal processes are implicit, unstructured, and undocumented; formal processes are explicit, structured, and documented.
Information All probability assignments are conditional on some information. Thus, we write P(AII) where I represents the information related to event A. Words and phrases like >, , >, and have previously been used in connection with subjective probability assessments. The concept of information must, however, be defined before these words and phrases give meaning in a Bayesian setting.
In order to define the concept of information in a Bayesian setting consider the following supposition. A ~totab> information It related to event A exists. If this information is available, event A will either be true or false. Hence P(AIIt) is either 1 or 0. If A represents the occurrence of an accidental event, total information means that we know how the equipment will perform and how the personnel involved will operate the equipment with 100 percent certainty. Of course, in practice this will never be the case since there will always be some uncertainty related to the outcome of future events.
The assessor's probability statement will be based on an information set I,,. This information set might be very small compared to the total information It and also on a different form. Based on the information Ia the assessor expresses his/her degree of belief regarding the outcome of an event by means of a probability. The level of information Ia can be appraised by others, and thus room is given for acceptance or rejection of the assessor's judgement. From the decision-maker's point of view, the information Ia is not necessarily representing the related to event A. For example, the assessor might not have access to relevant failure data, or he might be emphasising insignificant factors, etc. The >, denoted Ie, will be a reference level when the decision maker evaluates the credibility of the assessor. Hence, a large gap between Ie and I~ may lead to rejection of the expert judgement. On the other hand, if the decision maker considers the assessor to have the best available information (knowledge), Ie and Ia coincide.
The level of information Ie is defined through the qualities given to it by the person who wish to evaluate the credibility of the assessor. Thus, we note that the interpretation of the Ie related to an event is subjective and may vary from one evaluator to another.
212
L.B. Andersen et al.
FACTORS AFFECTING THE CREDIBILITY OF EXPERT J U D G E M E N T S Subjective probability is a measure of degree of belief, which reflects one's state of information. It is not only subjective but also variable since it can change from one situation to another. In general it is not possible to obtain repeated independent measurements of subjective probability from the same individual because he/she is likely to remember his/her previous thoughts and responses. Consequently, there are no procedures for the measurement of belief that permit the application of the law of large numbers to reduce measurement errors.
The difficulties involved in applying standard measurement criteria of reliability and validity to the measurements of belief give rise to the question of how to evaluate and improve assessments of subjective probability. Lindley et al (1979) apply three types of criteria called pragmatic, semantic (calibration) and syntactic. The pragmatic criterion, which is based on comparison with values, is found irrelevant in a full Bayesian framework where true probabilities do not exist. The semantic criterion is of course relevant, but in a reliability/risk context the probabilities are typically small (rare events) which makes it difficult and most often impossible to carry out a meaningful calibration. Coherence is clearly essential if we are to treat assessments as probabilities and manipulate them according to probability laws, thus the syntactic criterion applies.
Several experts can be involved in assessing input probabilities to a risk model that systematises and pull together expertise in different areas related to the same overall phenomenon. In a risk management context an evaluation of the analysis results requires reasonable consistency among the experts degree of belief and objective data ( is, of course, a highly subjective statement), cf. the semantic and syntactic criteria. Consistency is important when the management evaluate whether the Bayesian risk analysis results are useful as a basis for improved decision making. However, credibility related to the expert judgements are perhaps even more important. Four main problem areas are identified to have the potential of decreasing the credibility of expert judgements: 1. Gap judged by the decision maker, between the assessor's state of knowledge Ia and the Ie 2. The decision maker considers the Ie to be insufficient 3. Motivational aspects 4. Superficiality or randomness involved in transforming the assessors' state of knowledge into a numerical value If the decision maker considers the assessor's level of information (knowledge) be significantly lower than the , he/she will not have confidence in the results. The decision maker will be sceptical to the assessor as an expert. Trying to use the best expertise available does not fully solve this problem since in practice there will always be time and cost constraints. Sensitivity and criticality analyses should be used as guidelines for deciding when to call for additional expertise and/or more comprehensive decomposition of the specific problem under analysis. Even if the expert is considered to have the , there could be a confidence problem. The decision maker may judge the bi)* (aihi && a i < c i mov cmp jnl mov cmp
e a x , d w o r d ptr [ai] dword ptr [ci],eax
mov
dword ptr
[d],O0000001
jpl m o v jp2 ...
dword ptr
[d],O0000000
jle
J~
e a x , d w o r d ptr [ai] dword ptr [bi],eax
jp1 jpl
jp2
assembler code length" 9 lines bumps 3 calls'none
mov xor cmp setnle mov xor cmp setl imul mov
e a x , d w o r d ptr [ai] ecxr ecx dword ptr [ci],eax cl e a x , d w o r d ptr [ai] edx, edx dword ptr [bi] ,eax dl ecx, edx dword ptr [d] ,ecx
assembler code length" 10 lines jumps • none calls'none
Advances in Safety and Reliability: ESREL '97
327
Conditional jumps (If-then) For this type of sentences, the argument calculation can be linearized but, in general, it is impossible to avoid at least one conditional jump, which is the essence of the IF conditional sentence. The coding of this sentence can be linearized if the objectives are simple expressions related among them. For example, it can be observed in Table 4, different linearization possibilities for the case of assigning to one variable the greater value found among other two variables.
Example 1
TABLE 4 IF CONDITIONALSTATMENT Example 2 Example 3
. . .
. . .
. . .
{ int ai, bi, ci, d ;
{ int ai, hi, ci, d,
{ int ai, hi, ci, d,
. . .
if(ai>bi) ci=ai; else ci=bi; ,) assembler code length : 8 lines jumps : 2 calls:none
. . .
. . .
ci = ai > bi ? ai • hi" }
ci = ( ai > bi ) * ai + ( ai as possible of the program's use. An average of activation of operational functions, for which the program has been designed, defines this mission profile. An activation matrix of program's modules translates this profile.
Reliability metrics'framework. So the problem to solve appears to get first the axioms and then the main metric(s). The axioms are obtained after intensive examination of field gathered results, examining data describing software bugs, measures performed by software workbench used to develop the program. Attached to each axiom there are metrics that are the model translation of such axioms and which define the relation between the different P. As that approach appears evident and valid by application of these metrics to new programs, it is refined to be more accurate and precise. So the present status of the methodology may be represented as a net that relies basic characteristics and specifies the P sub-areas. Figure 2 illustrates the steps to obtain the overall program reliability figure, from metrics at P level (Product, Process, Profile) themselves based on basic characteristics.
Reliability metrics net At present time it is necessary to identify more precisely What are: • The different basic characteristics. • The metrics who rely these characteristics.
Advances in Safety and Reliability" ESREL '97
379
Program Metric1
I
I 6 1 Profil Metrics
roduct Metric
rocess Metric
Other characteristics
Other characteristics
Blic
/ Basic /
characteris/
Basic
/characteris /
.,~,/
/
characteris/
.,ioi/
-,~n /
Figure 2: Software Reliability metrics framework I
22 Program reliability
r 18 1 Module reliability
' I
/Avoidance / /characteristi7
'
ii
I
11 I I
Modulel Inherent reliability
5
6
/Detection / /Inherent / /eharacteristi?~ / m o d u l e l /
12
Modulen Inherent reliability
Module1non ~ Modulennon i testedcalls j testedcalls j
16
II
Process sub-area
~
17 t
13
Module 1total i Modulen total callsnumber callsnumber I J
7
/Inherent / /modulen /
/ characteristic#/ charactefistic/s
Standard development
{
Module1 ' Modulen " non-identical 1 non-identical i calls .) ~,,. calls t)
i
t_
I 9 ] IProc 10 n] Process ess detectio ~avoidancefactor) ~. factor ~
4
reliability
"1
Enhancement factor
t
I I Module 19 n
i
I
I
~ ActivSation/ matrix /
gram allotmen/ in m~tules
Functional activation
Product sub- area
Profii sub-a r e a
Figure 3" Software reliability metrics' net
380
RR. Leclercq
After several iterations according to the figure 1 above, a validated situation appears. The identification of sub-areas was a useful tool to progress. However it appears a not so simple distribution. Several times basic characteristics are linked from one sub-area to another. In those conditions, the present network is that which is defined in figure 3. If we attach to icons the subsequent definition, we have figure 3.
A preparationtask
An input set
A metric result
Figure 3 must be read bottom up and from left to fight. If we detail this figure, we count a total of 8 major metrics plus some other sub-metrics. These metrics gather, today, a set of 48 generic characteristics that are retained for their influence on software reliability. These characteristics are splited in three categories that count respectively 8, 22, 18" • Inherent characteristics. • Enhancement avoidance characteristics. • Enhancement detection characteristics. We present here after one of the most significative. Additionally it is necessary to precise the profile. The profile allows to def'me the duration, and how and when the functions of the program are solicited.
A significant metric The non tested call(s)of a program, Nr, that may conduct to a bug is one of the original metrics we developed. Programs' measurements were recorded. After different trials the subsequent surface appears suitable. 1E3 0.8.®.4~.2
Nr
900 800 700 600 500 400 300 200 100 Ri
~
~ ~ ~ ~ ~
1E3 900 800
700 600 500
~400
2E~
3E
~300
~ ~
200 100
~ ~ ~ Na 0.80.60.40.2 Figure 4: Number of non tested calls
Advances in Safety and Reliability: ESREL '97
381
Its formulation is:
Nr
"-
Ke
*
Nd
or
Nr
(1 - En) "-
- k0 ( Ri * Ln ( N a ) ) , , e
O- Ea~)
Na
. . t 1)
Where: - Nr is the number of non tested calls that may conduct to reveal a bug in operation. - Ke a coefficient of efficiency of the tests evaluated with enhancement factors. - Ea n the enhancement factor including only avoidance characteristics applied during development. - E n the enhancement factor including avoidance and detection characteristics. - Ri is the inherent reliability that describes the complexity of the specification. - k0 a form coefficient.
Na, E n, Ean,, Ri, are evaluated with the help of other metrics. Unfortunately we are not able to detail them here due to lack of place. Some are described in [LEC92].
DATA
BASE
Such a set of metrics will operate only if we establish values for its characteristics. It is a large difficulty. Many people have exercised in that field. For that purpose a lot have examined data bases, bugs collections and tried to gain statistical correlation between characteristics. Unfortunately, as we are aware, the results are not at the level of what they expected. A. Goel with whom we discussed this problem thinks that no answer may probably not obtain by this way. There are many reasons we may summaries. The characteristics expected as interesting were not or insufficiently recorded. As the data bases were built these characteristics were not retain as suitable for the use of the data base. So, the results were poor. In addition the number of needed recorded programs is so important due to the number of characteristics to discriminate that it is difficult to imagine that it may easily possible. So we have adopted another approach. This approach consists to gather the experience of > who by experience are able to define what are the influent characteristics and how influents are they. For that purpose a set of questionnaire has been developed to obtain a flexible frame to allow comparison and perform statistics. These statistics will provide the best estimation the influence of the different characteristics. In these conditions we have gathered studies based on that assumption. The main interesting was conducted by Soistman [SOIS85] under a US DOD contract. The approach was conducted at several levels: • The identification of characteristics, they have important impact on software reliability. • A first series of characteristics that aggregate the soitware reliability under metrics and submetrics based on a common recognition. • A quantification of these characteristics by the same way. The resultant quantification represents the > on characteristics that determine the software reliability. It was necessary to split the overall inquiry in several questionnaires more easy to manage. The frame of sub-questionnaire is closely related to sub-area defined previously. Today we have enlarged the data base that contains around one hundred experts' opinions.
EXPERIENCE Overview
With that approach of software reliability, studies have been conducted on several projects. In that condition we gain several kinds of experience:
382
ER. Leclercq 1. 2. 3. 4.
Validation of the metrics set. In case of problems, inputs for upd~iting the set in some particular areas. Operational experience in the management of reliability predictions in a project. Operational results directly applicable for the development of the concerned project.
Details
After present experiment we consider this set of metrics almost applicable to a large diversity of programs. Nevertheless the results must be taken into account with care. For each result it must be provided to the customer of the methodology why we obtain the different results. Nevertheless we do not consider we have the same confidence level as for hardware. So the results have more to be used in case of trades-off than as absolutes. For a while we had problems for programs that are composed of ten thousand or million lines of code. Today that problem is solved. At present one of the more difficult problem does not concern the methodology itself but the tool that processes metrics due to accuracy in some calculation when we study networks. We have at present time a large experience the management of different project in the field of defense, telecommunication, energy.... on program dealing with PC, workstation, dedicated development for application or system programs. Answers have been provided for improvement on specification, development process level, program architecture... Several of them was obtained in collaborations with other companies.
FUTURE The improvement will continue on different directions. They are: 1. Enrichment of the expert data base. 2. Treatment of applications to continue to validate the robustness of the sets of metrics, including comparison with bugs' collections on operational programs. 3. A tentative action to use a more close and complementary approach with the Capability Maturity Model (CMM) and with the European way for SPICE.
References ANSI/AIAA (1993). ANSI Recommended Practice for Software Reliability. Report R-013-1992. ANSIflEEE (1991). IEEE Standard Glossary of Software Engineering Terminology. Standard 729-1991. E. Fiorentino and E. Soistman (1985). Combined hardware/software reliability prediction methodology, Proceeding Annual Reliability And Maintainability Symposium. IEEE (1992). IEEE Standard for a Software Quality Metrics Methodology. Standard 1061-1992. Mac Call and al. (1987). Methodology for software reliability prediction. Study report RADC 87-171. P.R. Leclercq (1992). A software reliability assessment model. Proceedings of the Annual Reliability and Maintainability Symposium, Las Vegas, 1992, 294, 298. E. C. Soistman & K. B. Ragsdale (1985). Impact of Hardware/Software Faults on System Reliability. Study report RADC- TR85 228.
SOFTWARE RELIABILITY METHOD COMPARATIVE ANALYSIS FROM THE EXPERIENCE TO THE THEORY Emmanuel Arbaretier SOFRETEN Parc Saint Christophe, 10 avenue de l'entreprise, 95865 Cergy Pontoise Cedex
ABSTRACT This presentation deals with the use of different predictive analysis methods for software applications, so that it may be possible to anticipate maintenance problems which are specific to them. The first part concerns the different approaches which can be adopted, without forgetting the extremist method which consists in obtaining a complete mathematical validation of the specifications of the software, and in generating automatically the associated source code; this source code is assumed to be perfect, which means that it has no defect, and it will be subjected to no maintenance action, except those corresponding to the evolutions of the software. The second part presents the qualitative approach which enables to anticipate very precisely the characteristics of the maintenance tasks, through the identification of the most vulnerable and critical parts of the software. The third part describes the contribution of the quantitative methods, in particularly through different methods of mesurement of the improvement of the code, due to the maintenance action. The fourth part deals with the subtle problem of adaptation of the concepts which are commonly applied to the world of hardware, up to the world of software.
K E Y W O R D S
Reliability, Software, Hardware, Failure Analysis, Methods, Reliability Growth, Formal Languages, Likelihood Function
THE DIFFERENT APPROACHES: QUALITATIVE, QUANTITATIVE, FORMAL Different approaches do exist in the field of software reliability, and certain of these approaches are rather more adapted to the mastering of the maintenance issues, than others: - the qualitative approaches enable to identify the most vulnerable parts of the software, and to orient the test and validation actions on these elements, by targetting and provoquing the maintenance actions on these elements: this aspect will be developped in the second paragraph, through the example of the AEEL method (Analyse des Effets des Erreurs Logicielles - Analysis of the Effects of the Software Defects) - the quantitative approaches try to apply as much as possible to the world of softwares a transposition of the theoretical tools used in the world of hardware - the formal approaches which consist in applying to the specifications of the software mecanisms of logical prooves which avoid the appearance of failures due to design errors; certain of these languages are associated 383
384
E. Arbaretier
with automatic code generators which enable to expect maximal reliability of the sofware; one can for example classify these languages according to the methods which support them: • algebrical: Z, VDM, RAISE, B • with communicating behaviour: LOTOS, ESTELLE, SDL • synchrone: LUSTRE, SIGNAL, ESTEREL.
A
E
E
L
:
F R O M DESIGN TO SOFTWARE SUPPORT
The AEEL method can be considered as an adaptation to the software systems of the FMECA methodology, as applied to the hardware. The parallel use of the FMECA and AEEL studies allows the fact that the hardware and software parts of a system may be submitted to the same dependability analyses, according to comparable methods, in the frame of a homogeneous approach• The AEEL method particularly allows to emphasize critical points during development phases of the software, to increase the efficiency of the Quality Assurance process performed during this development cycle through a better selection of the test and validation tasks, and to make easier the identification of corrective actions and design improvement recommandations. The AEEL method allows to evaluate the criticality of a software from the criticality of every of its components; The principle of the analysis is to assume design error hypotheses about each of its elementary component, and to identify the consequences of these errors on: - the operating modes of the module on which they appear -
-
the operating modes of the other modules the global operating modes of the software or of the system The aim of one AEEL is to :
-
-
-
-
emphasize the weakest points in the design of the software by determining the components the defauts of which may have the most critical consequences identify the components (procedures, modules..) which are most critical in the frame of the architecture of the software because of their complexity or their strategic characteristics as to the operating modes of the system influence the test/validation policy of the software, and more generally the development Quality Assurance process, by giving it a more precise and efficient orientation anticipate the coming functional evolutions from observed limitations, and particularly due to the improvement of the software, regarding its potential failures The AEEL studies concern softwares with high operational requirements, expressed for example with following quality indicators:
-
performance : high volume of information, maximal response times, multiple transactions and requests, high input and output flows
-reliability/availability : high cost due to the interruption of the system mission, or to its unavailability -
functionalities : complexity and sophistication of the functionalities, extreme diversity and complexity of the operational scenarios
- safety : software which is critical, as to the safety of hardware and personnel
Advances in Safety and Relial~ility: ESREL '97
385
- human factors: software which is going to be used by an important population of users, heterogeneous, not very familiar with the computers, and able to reject the application. The AEEL is based on following steps: - to define the hypotheses of the Analysis - to identify the components of the software which are going to be submitted to the Analysis, by justifying the choices and evaluating the corresponding workload - for every component which has been previously selected, to determin the consequences of the different types of error assumed in the frame of the initial hypotheses, on the operating modes of the software, at different levels of the system, up to the global level, which corresponds to its main functions - to describe the detection devices, the test and validation tasks, as well as the corrective actions which have been associated with these defauts -to perform a synthesis of these elementary analyses, at the level of every component, so to define general design improvement recommandations for the software or preferential functional evolutions to schedule later. The tasks which are part of the AEEL methodology can be grouped according to following steps: - step 1 • P r e p a r a t i o n of the h y p o t h e s e s
• selection of the themes and objectives of the AEEL definition of the criticality scale (criticality levels) • list of the types of errors which must be simulated, and analysed on each component • interface of the AEEL with the performance of the project - step 2 : S y s t e m A n a l y s i s a n d W o r k l o a d D e f i n i t i o n
• realization of the Functional Analysis worksheets for every selected theme preparation classification of the modules and sorting • work schedule of phase 3 - step 3 : R e a l i z a t i o n o f the A E E L
• building of the different AEEL worksheets • global synthesis of the AEEL • production of the AEEL report • updating of the AEEL worksheets and report The AEEL study is iterative through the V development cycle of the software Nevertheless, it is interesting, that several iterations may have been performed before the coding phase, so that it may be possible to take into account at the lowest cost, those modifications which have been selected during the design process; this way, it will be possible to apply the test and validation tasks of the software components in relation with the defauts simulated, in later phases of unit testing, integration and validation R E L I A B I L I T Y G R O W T H MODELS: L I M I T S OF THE ANALOGY C O N C E R N I N G QUANTITATIVE T E C H N I C S APPLIED TO H A R D W A R E AND S O F T W A R E R E L I A B I L I T Y The interactions between software maintenance and its reliability are expressed againts the failure rate parameters with time decreasing formulas like:
386 MUSA: GOEL OKUMUTO SHANTIKUMAR
E. Arbaretier 1 ( t ) = C/MoTo[ M o - ( i - 1 ) ] for t e[ti-1 , ti] 1 ( t ) = a b exp[ - b t ] for t e [ ti-1 , ti ] 1 ( t ) = [ N - ( i - 1 ) ] a b exp[-bt] for t e [ t i - 1 , ti]
with i varying between 1 and n, and corresponding to debug actions on a module the failure rate of which 1 we want to evaluate, and ti - ti-1 identifying the time intervalls between two subsequent debug actions. In these models, the parameters C, Mo, To, a , b , N are estimated through maximization of the likelyhood function expressed from the series of the time intervalls seperating the different debug actions and mesured by the development engineers. These models describe on a different way the reliability growth process of the software modules; they have different properties, and give a different interpretation of how things happen when the failure appears, when the corrective action is performed, and how far the module is then improved. The hypothesis, under which failure rates 1 continuously decrease seem to be somewhat realistic; the sudden interruption of the curve at the moment the correction is performed is also rather convincing if we take into consideration that modifications introduced in softwares do improve every time its reliability on a very strong basis. But these models are satisfactory on a rather unequal way: for example, in MUSA's model, the uncontinuous decreasing of the failure rate, interval after interval is somewhat suspect, because one may think that that the more a program is used without showing any failure, the more its reliability increases, and thus the more its failure rate decreases. One would for example prefer to observe a regular decrease of 1 in every intervall seperating two successive failures: it is precisely what GOEL-OKUMUTO's model describes, but on the other hand, this doesn't take into account the discrete decrease of 1 i at every correction. In fact, SHANTIKUMAR's model seems to realize a synthesis of the hypotheses of MUSA and GOELOKUMUTO, but the numerical resolution of the equations to calculate the parameters leads to much more important difficulties. It's impossible, not to mention LITTLEWOOD's model, just to illustrate the theoretical critics of the hypotheses involved in the previous models: for example, MUSA's model, according to which the failure rate is rigourously proportionnal with the number of remaining errors, and decreases every time of the same quantity when a correction is applied, is mostly criticizable; indeed, according to their importance, the errors have a big or a small influence on the failure rate; for example, an error which is positioned in a software module which is activated very often will have a much more important contribution than an error located in a part of the program which is called more rarely. Moreover, one has to notice than the most critical errors will be probably detected first, and then, when half of the errors will have be detected, 1 will have been reduced at least much more than by half. That's why, to take into account the uncertainty characterizing the severity of the different errors corrected, LITTLEWOOD considers the parameters li as real independant variables which are distributed according to Gamma distribution laws. The models which have been previously presented are very much used and have been submitted to numerous validations. For this purpose, one can use KOLMOGOROV-SMIRNOV tests, to measure the difference between the theoretical partition function, that is to say, the one computed from the model (intervalls between failures, ore cumulated number of failures at a certain time) and the collected data. Tested validation is replicative if data have participated to the estimation of the parameters of the model, predictive in the other case.
Advances in Safety and Reliability: ESREL '97
387
The practical use of these models tends to proove that L I T T L E W O O D ' s model presents a better replicative validation criteria (64% of the tests accepted) and a better predictive validation criteria (65% of the tests accepted) than the two other models ( MUSA 46 et 50 %), GOEL O K U M U T O (50 et 45 %), if we get interested in the modelization of the partition functions of the intervalls between failures. If one gets interested in the partition function of the number of failures detected at a precise time, the three models give similar results for the replicative validation criteria (around 75% of the tests accepted) and for the predictive validation criteria. In summary, L I T T L E W O O D ' s model provides more precise results than the other models, but by paying the price for more difficult mathematical processing (the parameters are much more difficult to compute).
ADAPTATION OF THE RELIABILITY CONCEPT TO THE DEVELOPMENT PROCESS OF THE SOFTWARE The adaptation of the different SLI concepts to the development process of the softwares must be done, taking into account the fundamental differences between the inherent nature of the software and the one of the hardware; following board shows a certain amount of these differences: HARDWARE The failures may be caused by defaults which appeared during design, manufacturing, use or maintenance phases The failures may be cause by weareout phenomena or energy exchange. More often than not anticipating signs may help avoid the failure The maintenance actions which are applied to one equipment can not increase the inherent reliability. They only enable its overhaul according to a maintenance policy which has been defined precisely in advance
Reliability depends on weareout or screening phenomena; the failure rates can be decreasing, constant or increasing against the use time
Reliability is related with the environment factors.
Reliability can be predicted on a theoretical way, from the knowledge of the design of the hardware as well as its use conditions Reliability may be improved through the introduction of redundancies
At last, and above all, support policy of a hardware system can and must be defined in advance, in its total representation up to complete description of the content of every task
SOFTWARE The failures are mainly due to design errors, reproduction errors, or maintenance actions including regression There is no weareout phenomen. Most of the time, software failures do occur when it is not possible to anticipate The only possible maintenance action is the redesign of a piece of source code through its reprogramming, under the condition that the initial default may have been removed and no additional default has been introduced (no regression hypothesis): this will enable to increase its inherent reliability Reliability is not so much time-dependant; reliability may be improved along the time, but it is not a direct dependence against the use time. It is rather a timedependant function which will be dedicated to detection and error correction The external environment does not generally affect software reliability, except if it has an influence on the inputs of the software Reliability can be predicted from no theoretical base, as its exclusively depends on human factors playing their role at the moment of the design. Reliability may be improved by the introduction of redundancies, only if software elements constituting the redundancies have been developped and tested by different teams; in this case, however it is necessary to introduce vote. The maintenance policy of a software can only be defined in its principles; in fact the maintenance tasks must be anticipated as much as possible, for first and last definit application.
388
E. Arbaretier
CONCLUSION From the existing software reliability analysis methods, only one family has not been taken into account in our paper: this dealing with computation of Quality measurement indicators enabling to quantify the Quality characteristics of the source code of a software; these methods did not interest us as much as the others in ours paper, because they are only focused on parameters which are indirectly linked with the software reliability of the software. Among the previously described methods, formal methods are most satisfactory on the theoretical and intellectual aspects, because they very well take into account the fundamental differences existing between software reliability and hardware reliability; they are able to give the proof that a behaviour can never be reached by a software, or that a property is always verified. Simply they can proof the ~, which has perfectly no sense in hardware reliability. The only problem is that they are very difficul to apply and they require very specialized skill: for the time being, it does almost cost the same time and the same energy to develop a formal model to develop a software, than to develop the software itself! Our company only adopted this approach on very limited pieces of algorithms, on the basis of qualitative formal processing associated with Petri Network modelling. The two other methods (failure rate computation through reliability growth modelling and defaut simulation through AEEL) are issued from hardware reliability methods analogy. We only practised the first on an experimental way, to compare different types of models, but we did not yet find a customer able to provide on an industrial way sufficient data collection from every developper. The method we have most used for the last three years is the qualitative analysis described in this paper as AEEL; we applied it in the methodological framework of working group and it helped us improving as well softwares which had been developped for ten year§, as softwares which did only exist through their specifications. Every time it helped the development team to identify what should clearly be done either to be sure to avoid a certain type of most dreaded failure event due to a bug, either to be sure such bug is not in the software.
REFERENCES Bev LITTLEWOOD ~ Likelihood function of adebugging model for computer software reliability ~ IEEE TR Vol R30, N°2 p145 MUSA > IEEE Vol 68 N°9 SOFRETEN ~ < called module > E.g.: main fl main t2 flf2 That means, that the module "main" calls the modules "fl" and "12" and "12" is also called by "fl". The flow graph information consists of the node list (i.e., a list of the line numbers of the statements of a module) and a relation between these nodes, which represents the edges of the control flow graph. If there is more than one statement per line, the line number is extended by a character suffix to differentiate between the statements. E.g.: Node list 1
2a, 2b 3 4 Edges 1, 2a 2a, 2b 2b, 3 3,4 The example shows a simple linear sequence of statements whereby two statements exist in line 2. c) basic metrics from the source code. The number and type of metrics to collect depend on the necessities that arise from the analysis of the coding requirements as stated in the according guidelines and standards. Besides that, the analysis of the metrics correlated with quality attributes also has feedback on the collection of metrics.
Advances in Safety and Reliability: ESREL '97
421
A database system is used for the interface between the front-ends and the analysis kemel. That also facilitates later enhancements of the database if for example new guidelines or standards arise. The same database also contains the coding rules extracted from the guidelines and standards.
Development of the Analysis Kernel The analysis kemel produces results which -
-
present the macro structure of the source code (call graph of modules), show the micro structure of the source code (control flow within modules), identify data dependencies (data flow), form the basis for higher level metrics (software metrics), prove the conformity of the source code with specific requirements as stated in the according guidelines and standards (rule-driven analysis).
That is performed by static analysis, where static means that the code does not need to be executed. The call graph of the source code describes how the modules interact with each other. For each module a structural analysis of its control flow graph is made. The structural analysis identifies the code elements of the module (branches, loops .... ) including their nesting. For data analysis, it is necessary to take into account all the paths in the source code and establish the effects of data manipulations along all these paths. Such an analysis is done by reaching definition's analysis (RDA). The RDA is carried out module-wise. It combines the information about variable references and definitions with information about the control flow graph of a module obtained during structural analysis. The basic idea of RDA is to treat definitions of variables like individuals that travel in a control flow graph and then to see where they can reach. Knowing the variables referenced in a node, and all definitions reaching that node, it is possible to determine whether any reference uses an uninitiated value. Similarly unused definitions can be found. REVEAL collects basic metrics to calculate higher level metrics. The higher level metrics shall serve as measures for quality attributes like readability, portability, etc.. Finally REVEAL has to prove the conformity with specific requirements as stated in the according rules and standards. Following, one can see a few example requirements (taken from IEC 880 and IEC 1508). R1.The number of input and output parameters of a module should be limited to a minimum. R2.Limited use of pointer. R3.A module should have only one entry. Single exits are recommended. Requirement R1 and R2 does not have an explicit threshold value. That is often the case with the requirements from the guidelines and standards. Mostly they are formulated in a qualitative manner. Thus, some default values must be defined for those requirements to enable the comparison with the metric values gathered from the source code. These default values may also be language dependent and therefore have to be changeable by the user. Requirement R3 is quite easy to check, you only have to extract the number of entry and exit points for each module of the source code. To make REVEAL flexible it is foreseen that the user can incorporate his "own" guidelines and standards. That also implies the possibility to select certain set of standards and even single requirements from the whole set of standards to be applied to the source code.
422
H. Miedl
Analyzing the coding requirements from different guidelines and standards no contradictions between them were found, but there are sometimes differences in the rigor (e.g., prohibited, avoided, limited .... ).
Development o f the User Interface
To interact with REVEAL the user, i.e., the assessor or licensee, needs an interface that allows him to select the requirements from the guidelines and standards to proof and the analysis (e.g., data flow analysis) to perform. For that purpose a graphical user interface is used.
CONCLUDING R E M A R K S The front-ends for the programming languages ANSI-C and FORTRAN-90 have been developed. The development of the ANSI-C front-end is nearly complete. It entirely produces the control flow information as an abstract representation of a graph. Apart from some specific aspects regarding arrays and pointers, it also produces the data flow information for an ANSI-C program. The data flow information consists of a variable description comprising several specific lists (tables for variables, parameters, arrays, functions, structures and types) and a cross-reference list describing the usage of these variables in the ANSI-C program. For FORTRAN-90 those parts of the front-end that extract the control flow information have been developed. This was carried out based on a restrictively used FORTRAN-90 grammar. Regarding the control flow analysis a prototype already exists which identifies loops, single-entry/single-exit sections of the control flow graph, isolates the corresponding subgraphs and lists the paths in these subgraphs. Input of the control flow module is an ASCI-file describing the control flow graph in a formal way. They extract from the source code based on the same concept that is used by the front-ends for ANSI-C and FORTRAN-90 to represent the control flow graphs. Conceming the reaching definition analysis as part of the data flow analysis, the theoretical basis already exists and now has to be implemented. A large amount of guidelines and standards have been investigated as to which degree they contain requirements or recommendations on coding. The general impression was, however, that few of them define coding requirements in a form suitable to be checked automatically by a software analysis tool. Those that are able to be checked automatically have been extracted and now have to be correlated to the according source code metrics.
REFERENCES
Brummer, J., Kersken, M., M~xtz, J. (1994). Tools for Software Safety Analysis, Reliability Engineering and System Safety. Elsevier 46, 123-138. Miedl, H. (1996). Reverse Transformation of Normed Source Code - Development of a Tool to Demonstrate the Functional Equivalence of Normed Source Code with its Specification, in Probabilistic Safety Assessment and Management. ESREL '96 - PSAM-III 2, 1139-1144.
BI" PSA Applications
This Page Intentionally Left Blank
INDIVIDUAL PLANT EXAMINATIONS: WHAT PERSPECTIVES CAN BE DRAWN? M.T. Drouin 1, A.L. Camp s, J. Lehner3, T. PraY, J. Forester 2 1U.S. Nuclear Regulatory Commission, Washington D.C. 20555 USA 2Sandia National Laboratories, Albuquerque, NM 87185 USA 3Brookhaven National Laboratory, Upton, NY 11973 USA
ABSTRACT The U.S. Nuclear Regulatory Commission (NRC) issued Generic Letter (GL) 88-20 in November 1988, requesting that all licensees perform an Individual Plant Examination (IPE) "to identify any plant-specific vulnerabilities to severe accidents and report the results to the Commission. " The purpose and scope of the IPE effort includes examining internal events occurring at full power, including those initiated by internal flooding. In response, the staff received 75 IPE covering regarding 108 nuclear power plant units. The staff then examined the IPE submittals to determine what the collective IPE results imply about the safety of U.S. nuclear power plants and how the IPE program has affected reactor safety. The following paper summarizes the results of the IPE Insights Program examination.
KEYWORDS severe accident, core damage frequency, IPE, vulnerability, containment performance, human reliability, safety goal
IMPACT OF THE IPE PROGRAM ON REACTOR SAFETY The primary goal of the IPE Program was for licensees to "identify plant-specific vulnerabilities to severe accidents that could be fixed with low-cost improvements. " However, GL 88-20 did not specifically define what constitutes a vulnerability; hence, there is considerable diversity in the criteria used to define a vulnerability. In addition, it is not always clear whether a licensee is identifying a finding as a "vulnerability" or as some other issue worthy of attention. Therefore, a problem considered to be a vulnerability at one plant may not have been specifically identified as a vulnerability at another plant. In fact, less than half of the licensees actually identified "vulnerabilities" in their IPE submittals; however, nearly all of the licensees identified other areas warranting investigation for potential improvements. Thus, the IPE program has served as a catalyst for further improving the overall safety of nuclear power plants. Only four licensees with boiling water reactor (BWR) plants and 15 licensees with pressurized water reactor (PWR) plants explicitly stated that their plants had vulnerabilities. Although no common vulnerabilities were identified, the following vulnerabilities can be considered applicable to many BWRs: •
failure of water supplies to isolation condensers 425
426 • • •
M.T. Drouin et al. failure to maintain high-pressure coolant injection systems when residual heat removal has failed failure to control low-pressure injection during an anticipated transient without scram (ATWS) drywell steel shell melt-through as a Mark I containment issue
Similarly, the following vulnerabilities can be considered applicable to many PWRs: • • • • • • • • • •
loss of reactor coolant pump (RCP) seals leading to a loss of coolant accident (LOCA) design and maintenance problems that reduce turbine-driven auxiliary feedWater pump reliability internal flooding caused by component failures failure of the operator to switchover from the coolant injection phase to the recirculation phase loss of critical switchgear ventilation equipment leading to loss of emergency buses need to enhance operator guidance for depressurization during steam generator tube ruptures inadequate surveillance of specific valves leading to interfacing system LOCAs loss of specific electrical buses compressed air system failures inability to crosstie buses during loss of power conditions
In addition, almost all of the licensees identified plant improvements to address perceived weaknesses in plant design or operation. (Over 500 proposed improvements were identified by the plants.) Most of these plant improvements are classified as procedural/operational changes, design/hardware changes, or both. Few of the improvements involve maintenance-related changes. Typically, the procedural or design changes indicate revised training in order to propedy implement the actual change. The specific improvements vary from plant to plant. However, numerous improvements that had significant impact on plant safety include changes to AC and DC power, coolant injection systems, decay heat removal systems, heating, ventilating and air conditioning, and PWR RCP seals.
CORE DAMAGE FREQUENCY (REACTOR DESIGN) PERSPECTIVES In many ways, the IPE results are consistent with the results of previous NRC and industry risk studies. The IPE results indicate that the plant core damage frequency (CDF) is often determined by many different sequences (in combination), rather than being dominated by a single sequence or failure mechanism. The largest contributors to plant CDF and the dominant failures contributing to those sequences vary considerably among the plants (e.g., some are dominated by LOCAs, while others are dominated by station blackout). However, for most plants, support systems are important to the results because support system failures can result in failures of multiple front-line systems. Further, the support system designs and dependency of frontline systems on support systems vary considerably among the plants. That variation explains much of the variability observed in the IPE results. The CDFs reported in the IPE ~ubmittals are lower, on average, for BWR plants than for PWR plants, as shown in Figure 1. Although both BWR and PWR results are strongly affected by the support system considerations discussed above, a few key differences between the two types of plants contribute to this tendency for lower BWR CDFs and cause a difference in the relative contributions of the accident sequences to plant CDF. The most significant difference is that BWRs have more injection systems than PWRs and can depressurize more easily to use loW-pressure injection (LPI) systems. This gives BWRs a lower average contribution from LOCAs. However, the results for individual plants can vary from this general trend. As shown in Figure 1, the CDFs for many BWR plants are actually higher than the CDFs for many PWR plants. The variation in the CDFs is primarily driven by a combination of the following factors: •
plant design differences (primarily in support systems such as cooling water, electrical power, ventilation, and air systems)
•
variability in modeling assumptions (including whether the models accounted for alternative accident mitigating systems)
•
differences in data values (including human error probabilities) used in quantifying the models
Advances in Safety and Reliability: E S R E L '97
427
conditional probability for significant early release varies from less than 0.01 to 0.5 for the B W R IPEs and from less than 0.01 to 0.3 for the P W R IPEs. In the B W R IPEs, significant early releases are almost exclusively caused by early containment failure, while containment bypass (especially SGTR), plays an important role in the reported P W R releases: Table 2 summarizes key observations regarding containment performance.
TABLE 2 O V E R V I E W O F K E Y C O N T A I N M E N T P E R F O R M A N C E OBSERVATIONS
Key Observations By Containment Failure Mode i
i
i
Early F a i l u r e -
On average, the large volume containments of PWRs are less likely to have early structural failures than the smaller BWR pressure suppression containments Overpressure failures (primarily from ATWS), fuel coolant interaction, and direct impingement of core debris on the containment boundary are important contributors to early failure for BWR containments The higher early structural failures of BWR Mark I containments versus the later BWR containments are driven to a large extent by drywell shell melt-through* In a few BWR analyses, early venting contributes to early releases Phenomena associated with high-pressure melt ejection are the leading causes of early failure for PWR containments* Isolation failures are significant in a number of large, dry and subatmospheric containments The low early failure frequencies for ice condensers relative to the other PWRs appear to be driven by analysis assumptions rather than plant features For both BWR and PWR plants, specific design features lead to a number of unique and significant containment failure modes Bypass - -
Probability of bypass is generally higher in PWRs, in part, because of the use of steam generators, and because the greater pressure differential between the primary and secondary systems may increase the likelihood of an ISLOCA Bypass, especially SGTR, is an important contributor to early release for PWR containment types Bypass is generally not important for BWRs Late F a i l u r e -
Overpressurization when containment heat removal is lost is the primary cause of late failure in most PWR and some BWR containments High pressure and temperature loads caused by core-concrete interactions are important for late failure in BWR containments Containment venting is important for avoiding late uncontrolled failure in some Mark I containments The larger volumes of the Mark III containments (relative to Mark I and Mark II containments) are partly responsible for their lower late failure probabilities in comparison to the other BWR containments The likelihood of late failure often depends on the mission times assumed in the analysis *There has been a significant change in the state-of-knowledge reporting some severe accident phenomena in the time since the IPE analyses were performed.
428
M.T. Drouin et al. TABLE 1 (Continued) Key Observations By Accident Class
Station b l a c k o u t s -
Significant contributor for most plants, with variability driven by: • number of redundant and diverse emergency AC power sources • availability of alternative offsite power sources • length of battery life • availability of firewater as a diverse injection system for BWRs • susceptibility to RCP seal LOCAs for PWRs ATWS --
Normally a low contributor to plant CDF because of reliable scram function and successful operator responses BWR variability mostly driven by modeling of human errors and availability of alternative boron injection system PWR variability mostly driven by plant operating characteristics, IPE modeling assumptions, and assessment of the fraction of time the plant has an unfavorable moderator temperature coefficient Internal F l o o d -
Small contributor for most plants because of the separation of systems and compartmentalization in the reactor building, but significant for some because of plant-specific designs Largest contributors involve service water breaks L O C A s (other than interfacing system L O C A s (ISLOCAs) a n d SGTRs) - -
Significant contributors for many PWRs with manual switchover to emergency core cooling recirculation mode BWRs generally have lower LOCA CDFs than PWRs for the following reasons: • BWRs have more injection systems • BWRs can more readily depressurize to use low-pressure systems ISLOCAs --
Small contributor to plant CDF for BWRs and PWRs because of the low frequency of initiator Higher relative contribution to early release frequency for PWRs than BWRs because of low early failure frequency from other causes for PWRs SGTR --
Normally a small contributor to CDF for PWRs because of opportunities for the operator to isolate a break and terminate an accident, but important contributor to early release frequency
CONTAINMENT PERFORMANCE (CONTAINMENT DESIGN) PERSPECTIVES For the most part, when the accident progression analyses in the IPEs are viewed globally, they are consistent with typical containment performance analyses. Failure mechanisms identified in the past as being important are also shown to be important in the IPEs. In general, the IPEs confirmed that the large volume PWR containments are more robust than the smaller BWR pressure suppression containments in meeting the challenges of severe accidents. Because of the risk importance of early releases, the containment performance analysis descriptions found in the IPE submittals emphasized the phenomena, mechanisms, and accident scenarios that can lead to such releases. These involve early structural failure of the containment, containment bypass, containment isolation failures and, for some BWR plants, deliberate venting of the containment.
Advances in Safety and Reliability: ESREL '97
429
1E-3
At A t~
1E-4
i!,
aal
t.._ o sJ t~
AA
~
~Q. 1E-5
•
&&
eO"
,,- 1E-6 E "o O ¢~ 1E-7
AA
1E-8 BWRs
PWtLs
Figure 1: Summary of BWR and PWR CDFs as reported in the IPEs. Table 1 summarizes the key observations regarding the importance and variability of accident classes commonly modeled and discussed in the IPEs.
TABLE 1 OVERVIEW OF KEY CDF OBSERVATIONS Key Observations By Accident Class
Transients (other than station blackouts and ATWS) - Important contributor for most plants because of reliance on support systems" failure of such systems can defeat redundancy in front-line systems Both plant-specific design differences and IPE modeling assumptions contribute to variability in results: • use of alternative systems for injection at BWRs • variability in the probability that an operator will fail to depressurize the vessel for LPI in BWRs • availability of an isolation condenser in older BWRs for sequences with loss of decay heat removal
(Dim) • • • • •
susceptibility to harsh environment affecting the availability of coolant injection capability following loss of DHR capability to use feed-and-bleed cooling for PWRs susceptibility to RCP seal LOCAs for PWRs ability to depressurize the reactor coolant system in PWRs affecting the ability to use LPI ability to cross-tie systems to provide additional redundancy
430
M.T. Drouin et al.
As a group, the large dry PWR containments analyzed in the IPEs have significantly smaller conditional probabilities of early structural failure (given core melt) than the BWR pressure suppression containments analyzed. Nonetheless, containment bypass and isolation failures are generally more significant for the PWR containments. As seen in Figure 2, however, these general trends are often not true for individual IPEs because of the considerable range in the results. For instance, conditional containment failure probabilities (CCFPs) for both early and late containment failure for a number of large dry PWR containments are higher than those reported for some of the BWR pressure suppression containments. 1.0 0.9 .-_ 0.8 u ~ 0.7
.j
-= 0.6
,m
~ O.g
A& ah . • A m
°,..
i I t
= 0.4 C
AaA 1 o 0.3
°m
A~
A&ll A
o
•
A
1
&;
.4~A--
0.1
__w
0.0
Bypass
Early Failure
PWRs
Late Failure
Bypass
Early Failure
Late Failure
BWRs
Figure 2: Summary of CCFPs for BWRs and PWRs as reported in the IPEs. The results for BWRs, grouped by containment type, follow expected trends and indicate that, in general, Mark I containments are more likely to fail during a severe accident than the later Mark II and Mark IT[ designs. However, the ranges of predicted failure probabilities are quite high for all BWR containment designs and there is significant overlap of the results, given core damage. A large variability also exists in the contributions of the different failure modes for each BWR containment group. However, plants in all three BWR containment groups found a significant probability of early or late structural failure, given core damage. The containment performance results for PWRs indicate that most of the containments have relatively low conditional probabilities of early failure, although a large variability exists in the contributions of the different failure modes for both large dry and ice condenser containments. The results presented in the IPE submittals are consistent with previous studies regarding radionuclide release. The containment failure modes identified as resulting in an early release of radionuclides to the environment are containment bypass, isolation failure, and early containment structural failure. In BWR pressure suppression containments, early venting also leads to an early release in a few cases. A significant early release is of particular concern because of the potential for severe consequences as a result of the short time allowed for radioactivity decay and natural deposition, as well as for accident response actions (such as evacuation of the population in the vicinity of the plant). What is considered to be a significant release varies among the licensees. For many, significant release includes instances involving a release fraction of volatile radionuclides equal to or greater than ten percent of core inventory. Using this definition, the reported
Advances in Safety and Reliability: ESREL '97
431
ItUMA.N ACTION (OPERATIONAL) PERSPECTIVES Only a few specific human actions are consistently important for either BWRs or PWRs and reported in the IPEs. For BWRs, the actions include manual depressurization of the vessel, initiation of standby liquid control during an ATWS, containment venting, and alignment of containment or suppression pool cooling. Manual depressurization of the vessel is more important than expected, because most plant operators are directed by the emergency operating procedures to inhibit the automatic depressurization system (ADS) and, when ADS is inhibited, the operator must manually depressurize the vessel. Only three human actions are important in more than 50 % of the IPE submittals for PWRs. These include the switchover to recirculation during LOCAs, initiation of feed-and-bleed, and the actions associated with depressurization and cooldown. Plant-specific features, such as the size of the refueling water storage tank and the degree of automation of the switchover to recirculation, are key in determining the importance of these actions. While the IPE results indicate that human error can be a significant contributor to CDF, in most cases there is little evidence that human reliability analysis (I-IRA) quantification method per se has a major impact on the results. Nevertheless, numerous factors influence the quantification of human error probabilities (HEPs) and introduce significant variability in the resulting HEPs, even for essentially identical actions. General categories of such factors include plant characteristics, modeling details, sequence-specific attributes (e.g., patterns of successes and failures in a given sequence), dependencies, performance shaping factors modeled, application of the HRA method (correctness and thoroughness), and the biases of both the analysts performing the HRA and the plant personnel from whom selected information and judgments are obtained. Although most of these factors introduce appropriate variability in the results (i.e., the derived HEPs reflect "real" differences such as time availability and scenario-specific factors), several have the potential to cause invalid variability. In order to examine the extent to which variability in the results from the BWRs is caused by real rather than artifactual differences, the HEPs from several of the more important human actions appearing in the IPEs were examined across plants. The results from this examination indicated that some of the variability in the HEP values may have been an artifact of the way in which HRA methods are applied. Nonetheless, in most cases, it appears that there were explanations for much of the observed variability in HEPs and in the results of the HRAs across the IPEs. However, such an assertion does not necessarily imply that the HEP values are generally valid. Reasonable consistency can be obtained in HRA without necessarily producing valid HEPs. An H E is only valid to the extent that a correct and thorough application of HRA principles has occurred. For example, if a licensee simply assumed (without adequate analysis) that their plant is "average" in terms of many of the relevant PSFs for a given event, but appropriately considers the time available for the event in a given context, the value obtained for that event may be similar to those obtained for other plants. Yet, the resulting value may be optimistic or pessimistic relative to the value that would have bene obtained if the licensee had conducted a detailed examination of the relevant plant-specific factors. Thus, to reiterate, consistency does not necessarily imply validity. In addition, because many of the licensees failed to perform high-quality HRAs, it is possible that the licensees obtained H E values that are not appropriate for their plants.
IPEs WITH RESPECT TO RISK-INFORMED REGULATION In performing their IPEs, licensees elected to perform a Level 1 probabilistic risk analysis (PRA) and a limited Level 2 PRA. In addition, the majority of the licensees have indicated their intention to maintain and update these PRAs for future use. These IPEs/PRAs can provide the foundation for the increased, future use of PRA in risk-informed regulation. However, before an IPE/PRA can be used beyond its original purpose (GL 88-20), the quality of the IPE/PRA will need to meet the standards established for the specific application, which the IPE/PRA may or may not currently meet. The CDF analyses in the IPEs are generally robust and generally use acceptable methods. Given the limited staff review, it is believed that the licensees, collectively, have identified the important accident sequences. Therefore, if a particular application requires only the identification of important sequences (not a relative
432
M.T. Drouin et al.
ranking of those accidents), most of the Level 1 PRAs for these IPEs are adequate. The staff reviews of the individual IPEs identified any relevant exceptions to this conclusion. In regard to the containment performance and source term calculations (Level 2), these analyses are generally simplified or of lesser quality than the CDF analyses primarily because of the use of some methods that are limited in nature. Many of the analyses relied heavily on either the use of the MA.AP code or the use of a set of industry position papers, neither of which have a comprehensive treatment of severe accident phenomena. Although the core damage analyses in the IPEs are generally robust, the staff identified weaknesses in certain areas, primarily including analysis of plant-specific data, common cause failure data, and human reliability. The most important shortcoming for some of the IPEs is the HR , with the most significant concern being the use of invalid HRA assumptions that did not produce consistently reasonable results.
OVERALL CONCLUSIONS AND OBSERVATIONS In considering the perspectives discussed above, and the results reported in the IPE submittals, certain conclusions and observations can be drawn as summarized below: •
As a result of the IPE program, licensees have generally developed in-house capability with an increased understanding of PRA and severe accidents. Further, the IPE program has served as a catalyst for further improving the overall safety nuclear power plants, and therefore, the generic letter initiative has clearly been a success.
•
Areas and issues have been identified where the staff plans to pursue some type of follow-up activity. Areas under consideration are plant improvements, containment performance improvement items either not implemented or not addressed in the IPE submittal, and.plants with relatively high CDF or conditional containment failure probability (greater than 1E-4/ry and 0.1, respectively).
•
If an IPE is to be used to support risk-informed regulation, then additional review may be needed in areas where the IPEs appear to be weak, depending upon the application of the PRA.
•
Examining the IPE results against the results of NUREG-1150 comparisons with safety goals, a fraction of the plants have the potential for early fatality risk levels that could approach the safety goals' quantitative health objectives.
•
Many of the BWR and PWR plant improvements address station blackout (SBO) concerns and originated as a result of the SBO rule. These improvements had a significant impact in reducing the SBO CDF (an average reduction of approximately 2E-5 per reactor-year (ry), as estimated from the CDFs reported by licensees in the IPEs). With the SBO rule implemented, the average SBO CDF is approximately 9E-6/ry, ranging from negligible to approximately 3E-5/ry. Although the majority of the plants that implemented the SBO rule have achieved the goal of limiting the average SBO contribution to core damage to about 1E-5/ry, a few plants are slightly above the goal. In comparing the IPE results to NUREG-1150, the average CDFs estimated for both BWRs and PWRs in NUREG-1150 fall within the ranges of the CDFs estimated in the IPEs; the relative contributions of accident sequences in the IPE results are also consistent with the N UREG-1150 results; the conditional probabilities of early containment failure reported in NUREG-1150 (mean values) also fall within the range of the IPE results for each containment type. Generally, the specific perspectives discussed in NUREG-1150 are consistent with the IPE results; however, the results of the IPEs do not indicate (as discussed in NUREG-1150) that the likelihood of early containment failure is higher for ice condenser designs than for large dry and subatmospheric designs. The opposite trend (as seen by the IPEs) appears to be driven by the modeling assumptions made in the five ice condenser IPEs rather than any phenomenological or design-related reasons.
•
IPE results indicate areas in PRA where standardization is needed.
Advances in Safety and Reliability: ESREL '97
433
•
Unresolved safety issue (USI) A-45 ("Shutdown Decay Heat Removal Requirements") and certain other USIs and genetic safety issues (GSIs), primarily GSI-23 ("Reactor Coolant Pump Seal Failures"), GSI-105 ("Interfacing System LOCA in Light Water Reactors") and GSI-130 ("Essential Service Water System Failures at Multi-Unit Sites"), were proposed by licensees for resolution on a plant-specific basis. Other safety issues resulting from the IPEs were identified as candidates for further investigation.
•
Areas where further research regarding both severe accident behavior and analytical techniques would be useful and should be considered were identified.
•
Information from the IPEs/PRAs can be used to support a diversity of activities such as plant inspection accident management strategies, maintenance rule implementation, and risk-informed regulation.
REFERENCES USNRC, "Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance," NUREG-1560, Draft Report for Comment, October 1996. USNRC, "Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f)," Generic Letter 88-20, November 23, 1988. USNRC, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," NUREG-1150, December 1990.
This Page Intentionally Left Blank
PSA FOR CANDU-6 PRESSURIZED HEAVY W A T E R REACTORS : W O L S O N G UNITS 2, 3, AND 4 OF KOREA Myung-Ki Kim and Byoung-Chul Park ~Korea Electric Power Research Institute, 103-16, Munji-dong, Yusung-gu, Taejon, Korea
ABSTRACT Level 1 and 2 probabilistic safety assessments (PSAs) for both intemal and extemal events are being performed to meet one of the conditions for a construction permit for Wolsong units 2, 3, and 4 in Korea. These units are CANDU-6 Pressurized Heavy Water Reactors (PHWRs), and the study is the first comprehensive level 1 and 2 PSAs for CANDU type plants in the world. The detailed PSA includes an extensive fault tree, event tree analysis, human reliability analysis, and common cause failure analysis. Event trees have been developed for 35 internal initiating event groups. The preliminary results show that the total core damage frequency for Wolsong units 2, 3, and 4 each is similar to that for a typical PWR plant.
KEYWORDS PSA, CANDU, Core Damage Frequency, Severe Accidents, Plant Damage State, Wolsong
INTRODUCTION
Since the accident at TMI Unit 2 in 1979, the importance of the prevention and mitigation of severe accidents in nuclear power plants has increased. Many countries have focused research on understanding severe accidents, in order to identify ways to improve the safety of nuclear power plants. In Korea, the regulatory body, i.e., Korea Institute of Nuclear Safety (KINS), issued the Nuclear Safety Policy Statement in September 1994, which requests a plant-specific safety evaluation using a probabilistic safety assessment, and a severe accident management program based on this evaluation. To meet the construction permit condition requiring a probabilistic safety assessment for the Wolsong PHWRs, Korea Electric Power Corporation (KEPCO) has established a program to perform the level 1 and 2 PSAs including external events analysis. The project consists of two phases, a feasibility study (Phase 1) and a main study (Phase 2). The Wolsong 2, 3 and 4 units are CANDU-6 type plants, and there have been no comprehensive PSAs as for Light Water Reactors (LWRs). The feasibility study was performed over a five month period ('93.8 - '94.1). Its purpose was to determine the scope and methodology of the study for the CANDU type plant. The study has showed tKEPRI is a Research Center of Korea Electric Power Corporation (KEPCO). 435
436
M.-K. Kim and B.-C. Park
that even though Wolsong units have a different design concept compared to LWRs, full-scope level 1 and 2 PSAs including external events are needed to verify the safety, understand the most likely severe accident sequences, and provide necessary information for the accident management program. As a result, level 1 and 2 PSAs for the both internal and external events were started in September 1995 and will continue until September 1997. A detailed PSA has been performed in cooperation with Korea Atomic Energy Research Institute (KAERI), Korea Power Engineering Company (KOPEC), and Atomic Energy of Canada Limited (AECL), including an extensive fault tree, event tree analysis, a human reliability, and a common cause failure analysis. The paper describes the interim results along with the insights gained, largely focusing on level 1 PSA.
PLANT DESCRIPTION Wolsong Pressurized Heavy Water Reactors (CANDU-6 type, 600MWe each) are located in the southeast of the Korean peninsula. The Units 2, 3,and 4 are under construction and virtually identical with a limited number of shared facilities. The NSSS is supplied by AECL. The reactor consists of horizontal pressuretubes reactor, with fuel channels. Each fuel channel consists of a pressure tube which is surrounded by the calandria tube with CO2 gap. The moderator system cools and circulates the moderator in the calandria and acts as an emergency heat sink following a loss of coolant accident (LOCA). The primary heat transport system is arranged in two closed circuits to reduce the blowdown rate of reactor coolant in case of LOCA. Three special safety systems, Emergency Core Cooling system, Shutdown system, and Containment Dousing system are installed for preventing and mitigating potential accidents.
SCOPE AND METHODOLOGY Based on the feasibility study, the scope of this study has been determined as follows: level 1 and 2 PSAs for both internal and external (seismic, internal flooding, fire and other events) events as well as a framework for the accident management program. The level 1 internal events analysis was performed based on the Wolsong Units 2 PSA study, preliminary performed by AECL: refining the list of initiating events, where necessary, by surveying the operating experience Wolsong Unit 1 (already in operation); regrouping the initiating events for the efficiency of the work and the ease of review; performing additional analysis for defining the success criteria; incorporating common cause failures in system modeling; and supplementing the human reliability analysis. In the level 1 analysis for external events, the seismic analysis was performed using the NUREG-1407 method with Canadian practice. The fire and the flooding analyses were performed using a probabilistic method, and other external events such as high wind were analyzed using the progressive screening approach as recommended in the IPEEE guidance document. It was identified that there has been no experience of external events analysis for CANDU plants in the world. Also previous PSAs have indicated that the risk from external events could be a significant contributor to the core damage frequency depending on the unique feature of the plants under assessment. The level 2 PSA is being performed for the core damage sequences the frequencies of which are 1.0 X 107/ry or higher, with redefinition of plant damage states in connection with the construction of containment events. Also the containment ultimate strength, containment event trees, and source terms have been analyzed considering the characteristics of CANDU plants.
INITIATING EVENTS The first step of the level 1 PSA is the identification of initiating events that induce abnormal condition and
Advances in Safety and Reliability: ESREL '97
437
eventually may result in a core damage accident. The initiating events for Wolsong units 2,3, and 4 were selected from the operating experience and failure mode effects analysis (FMEA) to identify initiating events that either have happened or could happen as a result of hardware failures or human error. Particular attention was paid to the FMEA of support systems which resulted in intiating events associated with the component cooling system. They were finally regrouped into 3 5 initiating event group according to similar plant response. Table 1 shows some representative initiating events for Wolsong plants along with their frequencies and error factors of lognormal distribution.
EVENT TREES The purpose of an event tree is to determine the plant response to an initiating event and to identify the mitigating systems and necessary operator actions required to bring the plant to some final state following any accident sequence. In association with the mitigating systems fault trees, it is used to perform accident sequence quantification to derive the frequency of the endpoint or final state of a particular accident sequence. The endpoint is either a plant success state where fuel cooling is maintained with no radiation into containment, or a core damage state. The event tree also addresses the combination of the initiating events followed by mitigating system failures. The AECL, CANDU plant designer, implemented 11 plant damage states (PDSs) in order to define the final state of the event tree. PDS 0 represents those accidents which cause the most severe plant damage, i.e., rapid loss of core integrity, and PDS 10 represents the most minor transients such as deuterium deflagration in cover gas. In the level 1 PSA study, the core damage state instead of PDS is used as a final state to keep the consistency with the same level of PSA for PWRs. PDS 0, 1, and 2, which are classified in the AECL PSA study, are defined as the core damage. Each event tree for initiating event is constructed on the basis of plant behaviors following the accident. Table 1. Some Representative Initiating Events
Initiating
Frequency
Error
Event
(per year)
Factor
IE-LKC1
8.17E-2
2.0
Heat Transfer SystemLeak - With Operating D20 Feed Pump Capacity
IE-SGTR
1.0E-3
10.0
Heat Transfer SystemLeak - Steam Generator Tube Rupture
Description
IE-SL
1.35E-2
10.0
Small LOCA
IE-PCTR
8.46E-4
10.0
Pressure Tube and Calandria Tube Rupture
IE-FBS
2.0E-4
10.0
Feeder Stagnation Break
IE-BMTR
1.0E-5
10.0
Small LOCA - Multiple Steam Generator Tube Rupture
IE-LRVO
1.54E-2
3.0
Heat Transport Liquid Relief Valves Fail Open
IE-LL1
2.0E-4
10.0
Large LOCA - Large Diameter Pipe Break not Involving Containment
IE-HPFP
5.62E-1
3.0
Partial Loss of Heat Transfer SystemPumped Flow
IE-FWPV
2.05E-1
3.0
Loss of Feedwater Supply to SGs due to Failure of Pump and Valve
IE-FWB1
7.96E-4
3.0
Asymmetric FW Line Break - Outside Reactor Building Downstream of FW Regulation Station
IE-FWB2
8.6E-5
3.0
Asymmetric FW Line Break - Outside Reactor Building Upstream of FW Regulation Station
IE-LOCV
5.12E-2
2.0
Loss of Condenser Vacuum
IE-T
2.8
5.6
GeneralTransient
438
M.-K. Kim and B.-C. Park
HUMAN RELIABILITY ANALYSIS Human errors may occur before the initiating events, or while an operator is responding to an abnormal situation such as a loss-of-coolant accident or a general transient. The results of human reliability analysis ( H R ) can be validated through the review of the Abnormal Operation Manual and the simulator experiments of CANDU 6 NPP. In this study, the basic information for the HRA was obtained from an interview with Wolsong unit 1 personnel and other PSA documents for CANDU NPPs. The HRA follows the Systematic Human Action Reliability Procedure (SHARP) approach; for a detailed analysis of the significant human actions, ASEP or THERP methods are used. Also, a quantitative screening method using conservative values is used. The dependencies between multiple human actions are identified through the preliminary sequence quantification. The assumption and method used in the study is listed Table 2. Table 2. The Assumption and Method used in HRA Item
Assumption / Method
Screening Value
5.0 E-2
HEP Calculation
P =Pd + Pa - Pd x Pa
Dependency
5 Types according to THERP
Detailed HRA Method
ASEP/THERP
C O M M O M CAUSE FAILURE Common Cause Failure (CCF) generally is regarded as one of the most dominant contributors to core damage frequency. However, there is no CCF database for CANDU plants. Hence, it was decided to adapt the PWR CCF database to the Wolsong CANDU plants. Our comparison of the database for PWRs and CANDUs indicates that the levels of data are different for the major components for which CCF is modeled. For example, while the data for pumps in PWR is combined mechanical and electrical parts, in CANDU divided into separately so that we consider both as a basic event in fault tree model. In order to apply the CCF data for PWRs to detailed fault tree for CANDU pump, we review a boundary of component in a fault tree model and make the level of details the same. The CCF is quantified using the beta factor method and where its results are considered as conservative, the Multiple Greek Letter (MGL) method is used instead.
DATA BASE
Component reliability data for this study have been compiled primarily from operating experience at Ontario Hydro's generating stations, but include other sources, such as CANDU 6 operating experience where available. The primary source of data is "Component Reliability Data for CANDU Nuclear Stations", which was compiled in 1986. Where required data is not available, data from other sources such as Ontario Hydro fossil fuel station operating experience and external sources have been used. In addition, we try to developed limited data base for Wolsong unit 1 such as human error data and major some components. For this, we interviewed the plant personnel and collected plant trouble reports and generated plant specific data. Those data are incorporated into the HRA and used to estimate the probability of some undeveloped events.
ACCIDENT SEQUENCE QUANTIFICATION The objective of accident sequence quantification is to provide an evaluation of individual accident sequence impact and contribution to the frequency of core damage states. The quantification of core damage frequency is performed using KIRAP code in which the logical loops between the support systems are solved
Advances in Safety and Reliability: ESREL '97
439
automatically. After the cut sets are generated, which are then processed to remove mutually-exclusive events and cut sets which violate success criteria of the accident sequence. We expect the frequencies of sequences which cause the beyond design basis status to be 1.0E-6/ry or less, therefore the truncation limit of 1.0E- 10 is selected for the accident sequence quantification and used for all sequences in order to make sure all significant contributors to the sequence are included in the generated cut sets, and on the other hand, to limit the number of cut sets to a manageable number. After minimal cut sets for the sequences that result in the core damage state are obtained, the rule based recovery analysis is performed according to the recovery actions listed in Table 3. The unavailability of major systems is shown in Table 4.
UNCERTAINTY AND SENSITIVITY ANALYSES KIRAP's UNCERT program is used to determine the uncertainty of system failure probabilities. The uncertainty due to reliability data is being analyzed, and the uncertainty analysis due to data modeling and major assumptions is performed in detail. Table 5 shows the sensitivity study of the effects of human reliability analysis, mission time, common cause failure analysis, surveillance test interval on the core damage frequency and showed the positive effect and negative efect which mean a decrease in CDF and an increase in CDF, respectively.
RESULTS AND DISCUSSION A phase 2 PSA for Wolsong P HR 2, 3, and 4 has been performed with an extensive fault tree, event tree analysis including detailed human reliability and common cause failure analyses based on the typical PSA technique. Thirty five internal event trees have been assessed in terms of their safety implications. The preliminary analysis indicates that the total core damage frequency with recovery actions is of the order of 10 4/ry. It was analyzed that the detailed human reliability analysis and the use of 24 hour mission time reduce the CDF. In this study, we give credit to the second human actions with a conservatism about the dependency between human action; overall, such second human actions reduce the total CDF of the plant. On the other hand, an inclusion of CCF analysis increases the CDF to some extent. The dominant sequence to the core damage frequency is FWPV-11, namely, loss of feedwater supply to steam generator due to failure of pumps or valves. It contributes approximately 27% to the total CDF. Most of those sequences higher than 1.0E-6/ry include the failure of the shutdown cooling system and emergency water supply system. Sensitivity analysis is being carried out to optimize the surveillance test intervals for shutdown system # 1, #2, ECCS and shutdown cooling system. Also, the accident management program for the Wolsong PHWR units is developed using the severe accident insights gained from this study.
ACKNOWLEDGMENT The review and comments by Drs. Inn Seock Kim (KEPRI) and Joon Eon Yang (Korea Atomic Energy Research Institute) are gratefully acknowledged.
REFERENCES
A.E.Swain, (1987). ccident Sequence Evaluation Program Human Reliability Analysis Procedure, NUERG/CR- 4772, S.N.L. E.Swain and H.E. Guttman, (1983). Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Application, Nureg/CR- 1278, S.N.L. Chen, J.T., et al (1991). Procedure and Submittal Guidance for Individual Plant Examination of external Events (IPEEE) for severe Accident Vulnerabilities, NUREG- 1407, NRC Hannaman, (1984). Systematic Human Action Reliability Procedure (SHARP), EPR1/NP-3583,EPRI S.H.Han, (1989). KAERI Integrated Reliability Analysis Code Package (KIRAP), KAERI-PSA-002, KAERI
440
M.-K. Kim and B.-C. Park
K P.A.Santamaura et al., (1995). Overview of the CANDU 6 Wolsong NPP 2/3/4 Probabilistic Safety Assessment, Probabilistic Safety Assessment Methodology and Applications, PSA '95, November, 26-30, 1995, Seoul, Korea
Table 3. Some Representative Recovery Actions
Description
No
Actions
Probability
1
OR-CL4-30
7.6E-1
Operator Restore Class IV Power within 30 Minutes
2
OR-CL4-60
6.2E-1
Operator Restore Class IV Power within 1 Hour
3
OR-SST
0.1
Restore SST within 12 Hours
4
OR-PHT-S
0.1
Transfer to PHT mode SDC when SDC pumps fail due to mechanical problem
5
OR-N2-FW
0.1
Connect N2 bottles to regulating valves in condensate, feedwater system to restore feedwater supply
0.1
OR-DA-MKP
Make up to deaerator from demineralized water system via condenser hot well and condensate extraction pump
OR-RFT-AFW
0.1
Operator transfers water source to RFT for AFW
OR-MANUAL
0.1
Operator opens/closes the manual valve at local place
Table 4. Unavailability of Main Systems System
Unavailability
Shutdown System NO. 1
5.94E-4
Remarks
Shutdown System NO. 2
1.64E-3
ECCS (High/Low Pressure)
6.175E-3
ECCS (Long Term)
4.278E-3
Shutdown Cooling System
8.263E-2
Main Feedwater System
4.073E-3
No CCF Effect
Auxiliary Feedwater System
2.573E-2
Little CCF Effect
Emergency Water Supply
6.91E-3
Test Interval ( 3M -> 1Y)
Test Interval ( 3M -> 1Y)
System
Table 5. Effects on Core Damage Frequency Positive Effect
Negative Effect
Detailed Human Reliability Analysis
Common Cause Failure Analysis (Rough Estimation Based
Use of 24 hour Mission Time
on CCF Parameters of PWR)
Second Operator Action at Event Tree Level
Extension of Test Intervals for SDCS and ECCS
Rule-Based Recovery for All Sequences
LEVEL 2 PSA TO EVALUATE THE P E R F O R M A N C E OF THE D O E L I & 2 NPP C O N T A I N M E N T UNDER SEVERE ACCIDENT CONDITONS A.D'Eer ~, B.Boesmans 1, M.Auglaire 1, P.Wilmart ~, P.Moeyaert 2 ~Tractebel Energy Engineering, Avenue Ariane 7, 1200 Brussels 2 Electrabel, Doel 1&2 NPP
ABSTRACT
The objective of the Doel l&2 level 2 PSA is to evaluate in probabilistic terms the performance of the containment for core damage scenarios. The progression of the severe accident and its load on the containment is assessed by means of a logical model referred to as the Accident Progression Event Tree (APET). The PSA level 2 analysis shows that the Doel 1&2 containment prevents early loss of containment integrity during a severe accident. This is due to the low contribution of containment bypasses and to the extremely low probability of early structural containment failures. The late containment ruptures are dominated by basemat melt-through, whereas the late containment leaks mainly result from static overpressurisation. Sensitivity calculations have been performed to assess the contribution of the different severe accident management (SAM) measures (eg. auto-catalytic hydrogen recombiners) to the reduction of the containment failure probability.
KEYWORDS
PSA, level 2, containment performance, severe accident, APET, containment failure modes,SAM.
INTRODUCTION
In Belgium, each Nuclear Power Plant must be re-examined after ten years from the viewpoint of safety. The objective of this compulsory review is to compare the actual safety level of the unit with the safety level which would result from the application of the rules existing at the time of review. In this context, it was found to be desirable to perform a Probabilistic Safety Assessment in support of the ten yearly back-fitting process. The Doel 1&2 units are twin two loop Westinghouse PWRs, having an individual power output of 400 MWe. The primary containment is a spherical steel shell. 441
442
A. D' Eer et al.
The objective of the Doel l&2 level 2 PSA is to evaluate in probabilistic terms the performance of the containment for core damage scenarios. In addition, the contribution of several accident management (SAM) measures (eg. auto-catalytic hydrogen recombiners) to the reduction of the containment failure probability is assessed.
THE PLANT DAMAGE STATES. The Doel l&2 level 1 PSA analysis describes all accident sequences leading to core damage. The latter is defined as "at least 20% of the cladding material reaches a temperature above 1000°C ''. Beyond this temperature, the oxidation reaction of the zirconium present in the cladding escalates, and the integrity of the first barrier of the fission products is no longer guaranteed. The core is referred to as being damaged. The initiating events which have been considered in the level 1 analysis covers all internal events, for all power and shutdown plant operation modes. The level 2 PSA analysis is limited to the power modes only. The purpose of the Plant Damage State analysis task is to group the numerous and detailed level 1 core damage sequences into a limited number of states, such that the progression of the severe accident and the response of the containment will be identical for all the core damage sequences belonging to a given state• The Doel 1&2 Plant Damage States are characterised by 13 attributes : • • • • • • • • • • • • •
initiating event, pressure of the reactor coolant system, pressure of the secondary system, containment isolation, timing to core damage, status of AC power supply, status of DC power supply, status of SG feedwater supply, status of pressuriser relief valves, status of high head safety injection, status of low head safety injection, status of containment spray, status of containment heat removal.
THE ACCIDENT P R O G R E S S I O N EVENT TREE The key feature of a PSA level 2 analysis is the development of a severe Accident Progression Event Tree model (APET). The Doel 1&2 APET describes in detail the mechanisms leading to containment failure, by means of developing the progression of the severe accident starting from core damage. The model deals with both phenomenological events and system-oriented events (safety injection and recirculation in the RCS, containment heat removal). The following phenomena were addressed in the model : • RCS pressurisation due to hydrogen accumulation in the SG tubes • hot leg / surge line failure • stuck-open PORV as a result of cycling • SG induced tube rupture due to creep failure • core degradation as a function of possible recovery of injection • in-vessel hydrogen production, transport to the containment, and hydrogen bums
Advances in Safety and Reliability: ESREL '97 • • • • • • • •
443
in-vessel fuel coolant interactions vessel failure vessel thrust forces high pressure melt ejection direct containment heating ex-vessel fuel coolant interactions containment pressurisation core concrete interactions
In this large event tree, the evolution of the operation of key safety systems (high and low head safety injection, containment spray and fan coolers) during the progression of the accident is precisely described. In this way the interaction between severe accident phenomena and the operation of key safety systems during core degradation can be adequately modelled. A few examples are : recovery of low pressure in-vessel injection as a result of RCS pressure decrease, failure of fan coolers due to a hydrogen burn, actuation of spray signal due to steam build-up.
QUANTIFICATION OF THE APET The events appearing in the APET need to be quantified, implying that split fractions need to be assigned to different physically possible outcomes. Several sources of information have been used to quantify these split fractions. These include a considerable number of supporting calculations performed using a plant specific input deck for the severe accident code MELCOR, detailed measurements on engineering drawings to obtain geometrical containment data, laboratory measurements of concrete composition and properties, system reliability data (PSA level 1 fault trees), and finally human reliability analysis based on analysis of plant procedures. To promote a systematic approach to quantify the split fractions, specific quantification guidelines have been developed for assigning split fraction values. The evaluation of the APET by means of the EVNTRE code, i.e., the calculation of containment failure probabilities, is performed for initial boundary conditions being the Plant Damage States (PDS), which characterise the status of the plant.
THE CONTAINMENT FAILURE MODES Containment failure refers to loss of integrity of the last fission product barrier, i.e., structural containment failure, isolation failure (failure to isolate a penetration) and containment bypass (steam generator tube rupture or interfacing system LOCA). According to their size, structural failures are divided into leaks and ruptures. A leak implies that the size of the containment failure prevents containment pressurisation due to phenomena such as the generation of noncondensable gases from core concrete interactions and the steam production from molten debris cooling in the absence of containment heat removal. On the other hand a rupture is defined such that the size of the containment failure is large enough to depressurise the containment from its ultimate capacity down to atmospheric conditions in one hour. The Doel 1&2 APET allows for containment failure due to the following phenomena : • hydrogen combustion, • slow overpressurisation, • vessel thrust forces, • in-vessel fuel-coolant interactions,
444 • • • •
A. D'Eer et al.
steam spike, direct containment heating, ex-vessel fuel-coolant interactions, molten core/concrete interactions leading to basemat melt-through (BMMT).
Regarding timing of structural containment failure three separate categories are defined namely : containment bypass (before core damage or during the in-vessel phase), early containment failures (prior to or at vessel breach), and late containment failures (after vessel failure). Six Plant End States (PES) have been defined on the basis of both timing and size of the failures. The resulting Plant End States are : • bypass, • early leak, • early rupture, • late leak, • late rupture, • intact.
THE I M P A C T OF SAM MEASURES ON THE CONTAINMENT P E R F O R M A N C E The influence on the containment performance of several severe accident management measures has been investigated. The first two measures already are part of the existing plant and its operating procedures, and have been implemented on the basis of deterministic safety evaluation, namely : • depressurisation of the reactor coolant system during core damage; • the presence of auto-catalytic hydrogen recombiners, which have been recently installed. The last two measures result from instructions in the accidental operating procedures, which are intended to prevent core damage. However as a result of the Doel 1&2 containment layout, these actions have an impact on the progression of the severe accident and therefore can be interpreted in the context of a level 2 PSA as SAMs, namely : • use of the RWST to inject into the RCS or to spray into the containment, aiming at reactor vessel cavity flooding • use of a second RWST allowing for external cooling of the reactor vessel.
R C S depressurisation after core
damage
Depressurisation of the primary system by opening the PORVs is foreseen in the plant procedures when the temperature measured by the core exit thermocouples exceeds 650°C, indicating that the core has at least been partially uncovered and that the core degradation process has started. Depressurization of the primary system results in : • increasing the probability to reflood the core and arrest the core degradation process by means of low head safety injection; • reducing the probability of reactor vessel failure at high pressure, which may cause severe challenges to the integrity of the containment; • reducing the probability of an induced steam generator tube rupture as a result of creep failure.
Advances in Safety and Reliability: ESREL '97
445
This SAM action is incorporated as a separate event in the RCS pressure evolution subtree. Human reliability analysis is used to provide an appropriate value for the associated split fraction.
Hydrogen recombiners The design criteria for the autocatalytic hydrogen recombiners guarantee that the hydrogen concentration in containment remains below 5% (by volume) tbr a worst-case severe accident scenario, selected among a list of credible scenarios. Therefore, the presence of recombiners is modelled in the APET by ensuring that the hydrogen concentration always remains in the low concentration range, for which ignition of the H2/H20/air mixture is ruled out. Consequently containment failures due to hydrogen bums are insignificant.
Reactor cavityflooding As a result of its design, it is rather likely that the reactor cavity will be flooded if the RWST content is injected into the containment due to injection in the RCS or due to containment spray operation. The presence of water in the cavity is essential in the debris quenching process, as it enhances the probability of obtaining a coolable debris bed configuration in the cavity after vessel failure and thus reduces the risk of basemat melt-through.
External vessel cooling Plant procedures also call for the use of a second RWST (refill or use of RWST belonging to the twin plant). Although the purpose of this action is the restoration of injection into the reactor coolant system, it also allows to flood the containment to a level which is sufficient to establish external vessel cooling in an attempt to prevent vessel failure. This action is modelled by introducing into the APET a specific model for external vessel cooling: a sufficient quantity of water in the containment (2 RWSTs) and long-term containment heat removal to condense the produced steam. Successful extemal vessel cooling is guaranteed only if the fraction of melted core is sufficiently low. If the total amount of core material has melted, success of external vessel cooling is uncertain.
EVALUATION OF THE CONTAINMENT P E R F O R M A N C E Table 1 shows the probabilities of the different containment failure modes, for the reference case and for a series of sensitivity calculations. These results are still under review by the Utility and the Regulatory Body. The reference case, corresponding to the present status of the plant, includes all 4 existing SAM measures. The ruptures dominantly result from basemat melt-through. The leaks mainly result from static overpressurisation of the containment due to loss of containment heat removal. It follows that early containment failures are extremely unlikely. This can be easily explained by the high ratio of containment free volume to core power for the Doel 1&2 NPP. Furthermore sensitivity calculations have been performed to assess the contribution of the different SAM measures described earlier to the reduction of the containment failure probability. The results of these calculations confirm the positive impact of the SAM measures. The base case corresponds to an evaluation with no SAM measures at all.
446
A. D'Eer et al. TABLE 1 CONDITIONAL CONTAINMENT FAILURE PROBABILITIES PRELIMINARY RESULTS
X
x
!
x
I
P I i
t I
iii!!iii!ii 1 .
.
.
.
x
5.1E-1
3.5E-2
3.0E-3
3.8E-1
3.5E-2
3.8E-1
3.5E-2
5.3E-3 5.4E-3
i i
4.4E-3
8.0E-3
; 3.2E-1
[
4.5E-3
.
SAM 1 • RCS depressurisation SAM 3 • reactor cavity flooding
i
4.4E-1
i
r I
3.8E-3
! 3.2E-1
i
2.6E-1
,t
2.6E-1
i
L
SAM 2 • H 2 catalytic recombiners SAM 4 • external vessel cooling
Implementation of the first measure, being RCS depressurisation during core damage (sensitivity calculation 1), does not alter the base case results. There are basically two reasons for this : firstly most high pressure accident sequences also imply failure of low head safety injection, and secondly the containment structure of the Doel 1&2 NPP is strong, such that containment failure as a result of reactor coolant system or of vessel failure at high pressure is insignificant. Additional implementation of the hydrogen auto-catalytic recombiners (sensitivity calculation 2), reduces the occurence of late leaks drastically. Indeed as a result of these recombiners, failure of the containment fan coolers due to hydrogen bums is prevented, such that static overpressurisation due to loss of containment heat removal is also prevented. The impact of these recombiners on the containment performance is undoubtedly positive. However, even if late static overpressurisation can be considerably reduced, late containment rupture may still occur due to basemat melt-through as the reactor cavity remains dry for a considerable fraction of the severe accident scenarios. This is the reason why late ruptures due to basemat melt-through increase compared to the previous case. Furthermore additional implementation of reactor cavity flooding (sensitivity calculation 3), largely prevents containment rupture due to basemat melt-through if the amount of corium in the reactor cavity is limited. However, if containment heat removal has failed, which is the case for a large fraction of the core damage scenarios, the containment may still fail due to static overpressurisation. Indeed, the decay heat is removed from the reactor cavity to the containment free volume. As a result, late containment ruptures due to basemat melt-through become late containment leaks due to static overpressurisation. Finally additional implementation of extemal vessel cooling (reference case), only slightly reduces the risk of late containment ruptures due to basemat melt-through. External vessel cooling reduces the risk of vessel failure, and therefore reduces the probability of basemat melt-through. The reason why only a very slight reduction in risk is observed, is that containment heat removal is needed to avoid containment overpressurisation and to enable condensation of the generated steam in order to refill the reactor cavity.
Advances in Safety and Reliability: ESREL '97
447
CONCLUSION The PSA level 2 analysis shows that the Doel 1&2 containment prevents early loss of containment integrity during a severe accident. This is due to the low contribution of containment bypasses and to the extremely low probability of early structural containment failures. Sensitivity calculations confirm the benefit of the existing SAM measures.
REFERENCES
U.S. Nuclear Regulatory Commission (1990). Severe Accident Risks : An assessment for Five U.S. Nuclear Power Plants. NUREG 1150 Final Report, Washington D.C.,U.S.
This Page Intentionally Left Blank
R A O L - S I M P L I F I E D A P P R O A C H TO R I S K M O N I T O R I N G IN N U C L E A R P O W E R P L A N T S Zdenko ~imi61'2, Jim O'Brien 1, Steve Follen l, Vladimir Mikuli~i62 Yankee Atomic Electric Company 580 Main St., Bolton, MA 01740-1398, U. S. A.
[email protected],
[email protected],
[email protected] 2 Faculty of Electrical Engineering and Computing, University of Zagreb Unska 3, 10000 Zagreb, Republic of Croatia zdenko.simic @fer.hr, vladimir.mikulicic @fer.hr
ABSTRACT Probabilistic Risk Assessment (PRA) can provide safety status information for a plant during different configurations; an additional effort is needed however to do this in real time for on-line operation. This paper describes an approach to use of PRA to achieve these goals. A Risk Assessment On-Line (RAOL) application was developed to monitor maintenance (on-line and planned) activities. RAOL is based on the results from a full-scope PRA, engineering/operational judgment and incorporates a user friendly program interface approach. Results from RAOL can be used by planners or operators to effectively manage the level of risk by controlling the actual plant configuration.
KEYWORDS
Probabilistic Risk Assessment, on-line risk monitoring, maintenance
BACKGROUND AND INTRODUCTION A Probabilistic Risk Assessment (PRA) provides valuable information regarding Nuclear Power Plant (NPP) sensitivity to various events. The results of a PRA can be used to identify and prioritize the importance of different hardware, human actions and operating procedures to plant safety. PRA models the way accidents occur and progress at a NPP. The analyzed accidents are those leading to core damage. Each way the accident can occur is presented by an accident sequence. Each accident sequence consists of an initiating event and mitigating systems failures that lead to core damage. 449
450
Z. Simi6 et al.
A plant-specific PRA provides a whole spectrum of results: the core damage frequency, the rank of dominant accident sequences, component/system failure contributions and human error contributions (operation, test and maintenance). Initiating event contributions, and individual sequence contributions are also known. The information contained in the PRA can be used as a very effective tool for Risk Management. Here we will discuss how a plant-specific PRA, with some modification and adaptation, can be used to supply additional information for assessing new plant configurations. When a safety engineer knows the expected systems configuration (from the current plant state and the maintenance schedule), it is possible from the PRA to evaluate the impact of this configuration on the plant Core Damage Frequency (CDF), i.e., plant safety. PRA can also provide a list of currently operable equipment most important to safety in the analyzed configuration, and prioritize the restoration of inoperable equipment. Prioritization of different equipment can simply be achieved by a relative comparison of impact on the plant CDF. For this purpose, it is necessary to have a living PRA- model that is updated on a regular basis, and which can be quantified in a minimal amount of time. There is also a need to modify existing PRA models for this specific application with fast requantification capabilities. Possible solutions to this problem are discussed below: 1. Current PRA models are based on a combination of event trees and fault trees, which can differ significantly in size and level of detail from plant to plant. Linked fault trees and large event trees are two extremes in PRA methodologies. Quantification of the full PRA model provides the most accurate results, but is time consuming. The PRA model needs to be properly optimized to gain results in time for an appropriate solution. With the fight optimization, accurate results can be achieved with a reasonable number of accident sequences. 2. Less resource-intensive solutions can be achieved by using minimal cut sets instead of the complete PRA model. This is certainly a more incomplete and less accurate solution, but with a carefully chosen set of minimal cut sets, it can result in a very acceptable and dramatically faster solution. 3. The simplest solutions can be achieved by using a relevant systems and components matrix for the same purpose. This matrix is derived from the original PRA model and relevant elements (systems and components) are determined from an operating standpoint. The application of this method is very limited, because multiple combinations can not be accounted for. The solution presented in this paper, Risk Assessment On-line (RAOL) application is a mixed approach between matrix and cut-set methods. The method is more flexible than the matrix solution, but simplicity is still preserved. The application and results of RAOL are discussed below.
APPLICATION DESCRIPTION AND RESULTS This application was originally developed as a spreadsheet solution for the Maine Yankee (MY) NPP. RAOL is the modified version, developed with Microsoft (MS) Visual Basic. In this version, the interface between user and data/results is significantly improved. Presentation of results is also optimized. This application was developed primarily to monitor on-line maintenance activities. It is based on results from a full-scope PRA with importance measures, engineering/operational judgment, and industry experience. The purpose of this application is to generate instantaneous and cumulative risk information for various potential plant configurations. This knowledge can then be used by planners/operators to effectively control plant configurations acceptable level of risk.
Advances in Safety and Reliability: ESREL '97
451
databases, etc.). This, for example, is very important for communication with the maintenance schedule database. (Table 1 shows the RAOL database table headings.)
Figure 2: Dialog window for the event description. The assessment process is designed to estimate the instantaneous risk associated with any given configuration of systems, sub-systems and trains and the cumulative risk that results from that configuration. Figure 1 shows Key Safety Functions (KSF) and systems included in the model. TABLE 1 RAOL DATABASETABLESHEADINGS:
Key Safety Function Table: KSF
KSF_ID
EventType Table: EventType
Event_ID
ESubType
SYS Table: SYSJD
DesePC DeseSUL U s a g e
SubsNo
Subl
Sub2
Sub3
Sub4
KSFJD
NOTES
Cycle Table:
Cycle
StartDate
ONLSAMver
RIL (Cumulative Risk Log) Table: ConfigStart
PlantMode MaxOT PlantSeore ConfigDuration
CalcType
SUL (System Unavailability Log) Table: SYS_ID
Subsys PlantMode
Event_lD
OOS_Time BIS_Time OOS_l-lours WorkOrder Notes LogType
To do this calculation, the model uses a Risk Achievement Worth (RAW) derived from the Maine Yankee PRA as weighting factors to assess the importance of various out-of-service configurations. The instantaneous risk is evaluated and the cumulative risk is constrained by a maximum outage time for the existing configuration. A description of how one system is evaluated will explain the level of complexity that is incorporated in this model. A RAW value for SYS9 (Auxiliary Feedwater) is combined with the following systems: SYS6 (Component Cooling Water), SYS8 (Emergency Feedwater- EFW), SYS28 (Alternate Shutdown Sys.), SYS29 (EFCV Air), and all External Events (Seismic, Fire, Weather). SYS9 directly has impact on the state of Heat Sink (KSF 2). The impact of the SYS9 also depends on the status of the other systems, for example: SYS7 (Main Feed), SYS10 (Steam Dump and Turbine Bypass), SYSll (Condensate System), SYS25 (115kV Off-site Power), SYS 26 (Service Water), and SYS32 (Switchgear Ventilation). Table 2 shows complexity of these relations.
4 52
Z. 5~imi6 et al.
This specific application is an innovative, simplified approach, yielding valuable results for different configurations in the MY NPP. Using of this application can improve the understanding of the basic principles and problems in a risk monitor approach. The applied method post processes (filters) PRA results from Level 1 and Level 2 assessments. Development of values used in this method starts with the generation of matrix type Risk Achievement Worth (RAW) values for system trains. Expert judgments, reviews of plant dependencies, reviews of mitigation requirements for various initiators and existing code run results are then used to determine if the system/trains in a potential out of service combination are independent or functionally inter-related. If independent the values for each system/train can be "added". If functionally inter-related (e.g., Emergency Feedwater & Auxiliary Feedwater both perform secondary Heat Removal) a special code case must be run. Various methods are used to constrain the number of cases that are required to be run. For example: surrogate (more conservative) cases may be used for a combination. The results of the analyses are then programmed into the RAOL application. Table 2 contains an example illustrating how the method is implemented. This application is not designed to supersede any other plant control. It is intended to be used in conjunction with existing plant Technical Specification (TS) and Administrative Controls. An on-line maintenance safety assessment canbe performed: •
For scheduled activities identified during daily maintenance planning meetings.
•
When equipment failures occur which may alter the results of the assessment performed at the daily maintenance planning meeting.
•
Before authorizing unscheduled maintenance activities that may alter the results of the assessment performed at the daily maintenance planning meeting.
RAOL can be used as a tool to assess the safety implications of long range maintenance schedules when they are being developed.
Figure 1: System Status Tab: Screen with current plant configuration. The RAOL was developed for the MS Windows 3.1 and MS Windows 95 operating system environment, using MS Visual Basic 4.0 professional version as programming language. For all database operations the MS Jet database engine is used primarily with a MS Access database format. By using the database engine, it is possible to reach virtually all other database formats (dBASE, Open Database Connectivity, client-server
Advances in Safety and Reliability: ESREL '97
453
Figure 3: Plant Status Tab: Screen with summary information about cun~nt plant status. If, during the process of evaluating the various system/train requirements for each KSF, it is determined that a cross train situation exists, then the model ensures that the assessment reflects this condition. This requirement is applicable to any cross-train condition, whether it is prohibited by TS, or not. This function is designed to evaluate cross-train conditions that are not specifically identified by the KSF quantification model. For example: Train A of High Pressure Safety Injection and Train B of Containment Spray; AC Distribution Bus A and Train B of Low Pressure Safety Injection; or Emergency Diesel Generators 1B and EFW train A. This function provides a message and color code. TABLE 2 EXAMPLEOF SYSTEMAND EXTERNALEVENTDEPENDENCIES: SYS-9.
Number of Auxiliary Feedwater Trains Available (1, 0):
@MAX(@IF(S8R otherwise
~10-6
_ //~
CCDF in SPecif!ed _.~1 0 10-5
I
I
I
I
10-4
10-3
10-2
10-1
I
100
I
101
I
102
R: Release to Accessible Environment TRI-6342-730-16
Figure 1: Boundary line and associated CCDF specified in 191.13(a)
D.R. Anderson et al.
518
The following guidance is given by the EPA (p. 5242, U.S. EPA 1996): § 194.32 Scope of performance assessments. (a) Performance assessments shall consider natural processes and events, mining, deep drilling, and shallow drilling that may affect the disposal system during the regulatory time frame. (b) Assessments of mining effects may be limited to changes in the hydraulic conductivity of the hydrogeologic units of the disposal system from excavation mining for natural resources. Mining shall be assumed to occur with a one in 100 probability in each century of the regulatory time frame. This guidance and an extensive review of possible disruptions at the WlPP led to drilling intrusions and potash mining being the only occurrences incorporated into the definition of ~st. Specifically, the elements Xst of ~st are vectors of the form
Xst = [tl, ll, el, bl, Pl, al, t2,12, e2, b2, P2, a2 ..... tn, ln, en, bn, Pn, an ,tmin ] v
v
1st intrusion
2 nd intrusion
(3)
v
n th intrusion
in the 1996 WIPP PA, where n is the number of drilling intrusions, t i is the time (yr) of the tlh intrusion, Ii designates the location of the txh intrusion, e i designates the penetration of an excavated or nonexcavated area by the zxh intrusion, bi designates whether or not the txh intrusion penetrates pressurized brine in the Castile Formation, Pi designates the plugging procedure used with the t~ intrusion (i.e., continuous plug, two discrete plugs, three discrete plugs), ai designates the type of waste penetrated by the t~ intrusion (i.e., no waste, contact-handled (CH) waste, remote-handled (RH) waste), and tmin is the time (yr) at which potash mining occurs. The following guidance is also given by the EPA (p. 5242, U.S. EPA 1996): § 194.33 Consideration of drilling events in performance assessments. (2) In performance assessments, drilling events shall be assumed to occur in the Delaware Basin at random intervals in time and space during the regulatory time frame. (3) The frequency of deep drilling shall be calculated in the following manner: (i) Identify deep drilling that has occurred for each resource in the Delaware Basin over the past 100 years prior to the time at which a compliance application is prepared. (ii) The total rate of deep drilling shall be the sum of the rates of deep drilling for each resource. This guidance led to the drilling rate in the vicinity of the WIPP being determined as 46.8 intrusions/km2/104 yr, which leads to a rate of ~'d = ( 4 6 . 8 / k m 2 / 1 0
4
yr)(0.6285 km 2) = 2.94 x l0 -3 yr -1
(4)
for intrusions into the area (0.6285 km 2) marked by a berm used as part of a passive marker system (Figure 3, Helton 1996). Further, 100 yr of active institutional control (§194.41, p. 5243, U.S. EPA 1996) and 600 yr of passive institutional control (§194.43, p. 5243, U.S. EPA 1996) lead to the following timedependent drilling rate: ~,d(t) = 0 yr-1 for 0 < t < 100 yr, ~,d(t) = 2.94 x 10-5 yr--1 for 100 < t < 700 yr, and
~,d(t) = 2.94 x 10-3 yr "1 for 700 < t < 10000 yr. Drilling intrusions are assumed to be equally likely to occur at each node used in a discretization of the repository (Figure 3, Helton 1996). Further, the analysis uses specified probabilities for: encountering no waste (0.80) (i.e., an intrusion into a nonexcavated area), CH waste (0.18), or RH waste (0.02); encountering pressurized brine (0.08); and use of a one (0.02), two (0.68) or three plug (0.30) procedure to seal boreholes. The CH waste is emplaced in the repository in 55-gallon drums that come from 569 distinct waste streams, which also have assigned probabilities. As the CH waste
Advances in Safety and Reliability: ESREL '97
519
is emplaced in the repository in drums stacked three high, each drilling intrusion into CH waste is assumed to intersect three randomly selected waste streams, which leads to the vector notation used for ai. Finally, the distribution for tmi n is defined by the assumption that potash mining occurs at a rate of ~,m = 1 x 10-4 yr-1 (194.32(b)), with a time-dependent rate ~, m(t) then defined in the same manner as shown for ~, d(t). The preceding assumptions define (~st, ~st, Pst).
3. EN2: ESTIMATION OF RELEASES
The entity EN2 is the outcome of the model development process for the WIPP and provides a way to estimate radionuclide releases to the accessible environment (i.e., values for Qi and hence R in Eq. (1)) for the different futures (i.e., elements Xst of Sst) that could occur at the WIPP. Estimation of environmental releases corresponds to evaluation of the function f in Figure 1. Release mechanisms associated with f include direct removal to the surface at the time of a drilling intrusion (i.e., cuttings, spallings, brine flow) and release subsequent to a drilling intrusion due to brine flow up a borehole with a degraded plug (i.e., groundwater transport). The primary computational models in the 1996 WIPP PA are illustrated in Figure 2. Most of these models involve the numerical solution of partial differential equations used to represent material deformation, fluid flow or radionuclide transport. It is the models in Figure 2 that actually define the functionf in Figure 1. As indicated in Figure 1, the CCDF specified in 191.13(a) can be formally defined by an integral o f f over ~st. In practice, this CCDF is never obtained by direct evaluation of an integral due to the complexity of f and ~st. Rather, an approximation procedure based on importance sampling (Helton and Iuzzolino 1993) or Monte Carlo (random) sampling (Helton and Shiver 1996) is used. The 1996 WIPP PA uses a Monte Carlo procedure. Specifically, elements Xst,i, i = 1, 2 ..... nS, are randomly sampled from ~st in consistency with the definition of (~st, Zest, Pst). Then, the integral in Figure 1, and hence the associated CCDF, is approximated by
nS
prob(Rel > R)=
~Sst6R[f(Xst)ldst(Xst)dVst - Z 6R[f(Xst,i)]/nS" i=1
CUTTINGS_S
GRASP-INV
CDUl?bom~;e ~
E ~'_~
wO
j~.(Release of Cu.ttings, Spallings, Brine to
~'~ t~
Transmissivi
i
[~P'- Upper Shaft Seal System
1 I
A~dliteL;ye dB
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Panel Seal
u_ •~ cu o
Fields
_SECOFL2D/SEC OTP2D
BRAG~~O '~"-(Brine Flow)
...............
MB139 I j
PANEL/NUTS
(Radionuclide Concentration) ,u,
Ieservoir]
........... I .........................
Not to Scale
u,ace
Boundary ~ of Accessible Environment
t
it t I t
TRI-6342-3401-10
Figure 2: Computer programs (models) used in 1996 WIPP PA
(5)
D.R. Anderson et al.
520
The models in Figure 2 are too computationally intensive to permit their evaluation for every element Xst, i of Sst in Eq. (5). Due to this constraint, the models in Figure 2 are evaluated for representative elements of Sst and then the results of these evaluations are used to construct values of f for the large number of Xst, i in Eq. (5).
4. EN3: PROBABILISTIC CHARACTERIZATION OF PARAMETER UNCERTAINTY The entity EN3 is the outcome of the data development effort for the WIPP and provides a probabilistic characterization of the uncertainty in the parameters that underlie the WIPP PA. When viewed formally, EN3 is defined by a probability space (Ssu, ZCsu,Psu), with the sample space Ssu given by
Ssu = { Xsu: Xsu is possibly the correct vector of parameter values to use in the WIPP PA }.
(6)
The subscript su refers to subjective (i.e., epistemic) uncertainty and is used because (Ssu, ZCsu, Psu) is providing a probabilistic characterization of where the appropriate inputs to use in the WIPP PA are believed to be located. In practice, Xsu is a vector of the form Xsu = Ix1, x 2 ..... XnV ], where nV is the number of uncertain variables under consideration, and (Ssu, ~u, Psu) is obtained by specifying a distribution Dj, j = 1, 2 . . . . . n V, for each element xj of Xsu. The preceding distributions correspond to the distributions in 194.34(b). In concept, some elements of Xsu can affect the definition of (Sst, Zest,Pst) (e.g., the rate constant ~,d in Eq. (4) used to define the Poisson process for drilling intrusions) and other elements relate to the models in Figure 2 that determine the function f in Figure 1 and Eq. (5) (e.g., radionuclide solubilities in Castile brine or fracture spacing in the Culebra Dolomite). However, all elements of Xsu in the 1996 WIPP PA relate to the models in Figure 2 (Table 1, Helton et al. 1997). If the value for Xsu was precisely known, then the CCDF in Figure 1 could be determined with certainty and compared with the boundary line specified in 191.13(a). However, given the complexity of the WIPP site and the 10,000 yr period under consideration, Xsu can never be known with certainty. Rather, uncertainty in
Xsu as characterized by (Ssu, ~su, Psu) will lead to a distribution of CCDFs as indicated in 194.34(c) and (e) (Figure 3a). The proximity of this distribution to the boundary line in Figure 1 provides an indication of the confidence that 191.13(a) will be met as required in 191.13(b). The distribution of CCDFs in Figure 3a can be summarized by distributions of exceedance probabilities conditional on individual release values (Figure 3b). In concept, these distributions are defined by double integrals over ~su and ~st (Helton 1996). In practice, these integrals are too complex to permit a closedform evaluation. Instead, the 1996 WIPP PA uses Latin hypercube sampling (McKay et al. 1979) to evaluate the integrals over ~su and, as indicated in Eq. (5), simple random sampling to evaluate the integrals over Sst. Specifically, a Latin hypercube sample (LHS) Xsu,k, k = 1, 2 ..... nLHS, is generated from ~su in consistency with the definition of (Ssu, ZCsu,Psu), and a random sample as indicated in conjunction with Eq. (5) is generated from Sst in consistency with the definition of (Sst, Zest, Pst). The quantile values in Figure 3b are then approximated by solving
prob(p 1000 years • Corrosion products act as a chemical buffer
.
.
.
~i~ii!!
.
.
.
.
.
ii~ii~!!i!!!!!!!i!!iii~
:
!
~,~;~, ~~i'!,'i,'~,'i~~ii~~,~i ,i'~,'ii~i~ii~i~i~i~i!ii~i~i~i~.~ii~i~i~i!i~i!~i~:.:/ Bentonite • Low solute transport rates (Diffusion) - Retardation of radionuclide transport (Sorption) - Chemical buffer • Low radionuclide solubility in porewater • Colloid filter • Plasticity (self-healing following physical disturbance)
. . . . .
i . . . . . . . . . .
Geological barriers R e p o s i t o r y zone: • Low water flux • Favourable hydrochemistry - M e c h a n i c a l stability Geosphere: • Retardation of radionuclides (sorption, matrix diffusion) • Reduction of radionuclide concentration (dilution, radioactive decay) • Physical protection of the engineered barriers (e,g. from glacial erosion) __
Figure 1"
~ r Lg~ zone: : : :.: ~ ~:
"
.
.
.
.
!
t . ::::~~::.:~.::i~:/~:~;.
i ,il
i
The system of safety barriers for disposal of HLW in the crystalline basement of Northern Switzerland
Regulatory criteria Site
investigations
Laboratory studies Design studies Detail modelling
Nagra ..._~ System % ~derstanding~ Identify FEPs1
:I ~"
Scenario
development
:
Detailed performance modelling Safety
assessment
modelling
Robust safety ,demonstrationl
:_. :-
i
sl
System
!
concept
~-*
i
"
Safety
assessment~ concept
screenin Robust
-~ reserve l I FEPs j I
4-
safety assessment concept
reserve] FEPs
no ~ _ Demonstration
Figure 2:
; Audit against ~ international studies and i FEP lists
I . . . . . . screenings--
.
proced~
I 4--
FEP catalogue
Identify influence
Safety concept
.
I requirements 'for next I phase
'l!
T .
.
of safety
I ,.J
The central r6le of the scenario development procedure for assessing repository performance (FEPs = Features, Events and Processes)
580
I.G. McKinley et al.
Of particular interest is the "robust" scenario which, based on the philosophy presented by McCombie et al. (1991), attempts to bound worst expected performance of the repository system. Even though the host rock and surrounding geological formations can greatly retard any radionuclides released from the repository, it is difficult to preclude the existence (or formation within the next few millennia) of flow paths which short circuit this barrier. The robust case thus focuses on the engineered barriers - here only minimum credit is taken for the geology which serves predominantly to protect these barriers and isolate them from processes occurring on the surface. The wellestablished low corrosion rate of the glass waste form, low solubility of some important radionuclides and their slow diffusion through compacted bentonite - together with dilution in the eventual exfiltration zone - are sufficient to ensure that performance guidelines are met (Fig. 3).
PRESENTATION OF REPOSITORY ASSESSMENT RESULTS Safety assessments of the Swiss HLW disposal system indicate that, under expected conditions, no significant releases of radioactivity are to be expected within one million years after disposal. After this time period, the toxicity of the repository has decreased to levels similar to that of the radioactivity contained in the overlying granite and further quantitative analysis becomes meaningless. A critical point to communicate to the general public is that the analyses carried out do not "predict the future", they merely evaluate the potential consequences for a wide set of possible futures (scenarios) which should bound the range of expected system behaviour, but need not directly simulate reality. The presentation of quantitative dose/time plots for such scenarios can give a false impression of level of confidence in numerical v a l u e s - even for a specified evolution of the system, the accuracy with which it can be simulated decreases with time. To draw attention to this latter point, dose/time curves have background shading (cf. Fig. 3); the clear area up to 104 years indicates that we have reasonable confidence in numerical values until the next expected period of glaciation. Thereafter, results are much more illustrative and, by 106 years, can be considered only as an indicator of whether calculated releases are increasing or decreasing. Shading also indicates a cut-off for completely negligible doses at 10-7 mSv a-1. In fact, this cut-off is probably far too low - being -2 orders of magnitude below the dose resulting from drinking one glass of average Swiss mineral water per year. However, more reasonable cut-off, 10-4 mSv a-1 for example, would result in the calculated doses for many scenarios not being displayed because they lie far below this limit. Two further points which emerge when presenting the safety case are demonstration of completeness of the scenarios considered and verification/validation of the models/databases used to quantify these scenarios. In both these cases, confusion arises because (as in all applied science) rigorous mathematical proof of completeness or validation is not possible and hence somewhat weaker use of these terms must be accepted. An element of expert opinion or consensus is unavoidable (cf. McCombie & McKinley, 1993; Sheng et al., 1993). An important confidence-building measure for the issues of scenario completeness and model verification (including complete assessment model chains) involves comparison exercises between independent groups working on similar repository systems. Validation - demonstrating that the codes and databases are sufficiently realistic for the scenario to be simulated - is somewhat more difficult. A certain amount of support for the models/databases can be provided by well designed laboratory or field experiments; the very long timescales involved can, however, be approached only by studies of natural analogues (McKinley, 1993; Miller et al., 1994). Nevertheless, despite the increasing uncertainty in boundary conditions as systems of increasing age are studied, natural analogues can provide convincing support for the general applicability of some models and the "reasonableness" of the conclusions derived. For the general public, in particular, qualitative demonstration of the persistence of extremely rich uranium ore bodies for hundreds of millions of years in relevant environments can be more convincing than mathematical analyses of expected repository performance. Even for more technical audiences, the consistency of extrapolation of laboratory data with analogue observations can be reassuring (e.g. comparison of short-term iron corrosion data from the laboratory with the corrosion observed in archaeological artefacts which have been buried for two or more millennia).
581
Advances in Safety and Reliability: ESREL '97 10 2
.
10 0
_
.
.
.
.
.
.
.
.
.
.
.
.
.
Natural radiation exposures in
E Regulatory guideline (0.1 mSv per year)
~
lO-2
E 0
lO-~
0 N
10 -6 ~
c
j
-~
10-8 ~
t-
10 2
10 4
10 6
Time after repository closure [years]
Figure 3:
Time development of annual individual doses in the Robust Scenario
In Switzerland, our experience has been that it is possible to communicate the technical arguments supporting the safety of our repository concept to most of our target audiences. A convincing case can be made that, under expected conditions, the health consequences from such a facility would be negligible. Concern tends to be focused on very low probability events (meteorite impact, major earthquake, etc.) which could render the entire analysis inapplicable. For repositories at great depth, most "catastrophic" events in the biosphere (floods, dam-bursts, etc.) would have insignificant effects on safety. In most cases, indeed, repositories would be little influenced by long-term processes associated with the next ice age. Major catastrophes, like impact of a meteorite large enough to disturb a 1 km deep repository, can be argued both to have extremely low probability (-10 -12 a -1) and to have associated direct physical effects which would render the radiological effects of repository perturbation negligible in comparison. An open area which remains is human intrusion E whether accidental or deliberate. It is plainly meaningless to attempt to predict the development of either society or technology over decades, much less centuries or millennia. All that can be done is to argue that accidental intrusion is unlikely (due to great depth, absence of resources) and will not lead to any major environmental disaster, while deliberate intrusion is extremely costly based on present-day technology. This limitation in the analysis must be accepted and, in the Swiss case, is incorporated in the relevant performance guidelines.
CONCLUSIONS Regulatory authorities specify quantitative performance goals for deep HLW repositories which are required to be met for geological periods of time. A formal methodology has been developed and widely applied to assess the extremely low risk from such repositories and develop a safety case to demonstrate compliance with guidelines. Although based on quantitative analyses, the safety case also rests upon a wide range of qualitative arguments to support the reasonableness of the conclusions reached. For presentation to the general public, such qualitative arguments become more important and are a focus for public information projects. Despite the general distrust and fear of all things nuclear, it makes public discussion of risks associated with radioactive waste disposal particulary challenging. It does, however, seem possible to convince key audiences that repository safety can be demonstrated. As the spotlight slowly shifts to focus attention on the very long-term consequences of other major engineering projects, it may be that some of the approaches developed in nuclear waste management can be usefully adopted elsewhere.
582
I.G. McKinley et al.
REFERENCES McCombie C., McKinley I.G., Zuidema P., 1991: Sufficient validation - The value of robustness in performance assessment and system design; In GEOVAL-1990, Symposium on Validation of Geosphere Flow and Transport Models, pp598-610, OECD/NEA, Paris, France McCombie, C. & McKinley, I., 1993: Validation - Another perspective; Groundwater, 31, pp530-531 McKinley, I.G. 1993: The r61e of natural analogues in nuclear waste repository performance assessment with particular emphasis on experience in Switzerland; Reliability Engineering and System Safety, 42, 233-246, 1993 Miller, W., Alexander, R., Chapman, N, McKinley, I, Smellie J., 1993: Natural analogue studies in the geological disposal of radioactive wastes; Nagra Technical Report series, NTB 93-03, Nagra, Wettingen, Switzerland Nagra, 1994a: Kristallin-I: Safety Assessment Report; Nagra Technical Report series NTB 93-22, Nagra, Wettingen, Switzerland Nagra 1994b: Kristallin-I - Conclusions from the regional investigation programme for siting a HLW repository in the crystalline basement of Northern Switzerland. Nagra Technical Report series, NTB 93-09E, Nagra, Wettingen, Switzerland Sheng, G., Elzas, M.S., Oren, T.I., Cronhjort, B.T., 1993: Model validation - A systemic and systematic approach; Reliability Engineering and System Safety, 42, 247-259, 1993 Sumerling, T.J., Zuidema, P., Grogan, H.A., van Dorp, F., 1993: Scenario development for safety demonstration for deep geological disposal in Switzerland; Proc. 4th Int. Conf. on High-Level Radioactive Waste Management, Las, Vegas, USA, pp 1085-1092, American Nuclear Society, La Grange Park, IL, USA
B7" Safety of Nuclear Waste Disposal
This Page Intentionally Left Blank
PARALLEL COMPUTING IN PROBABILISTIC SAFETY ASSESSMENTS OF HIGH-LEVEL N U C L E A R WASTE A. Pereira, M. Andersson and B. Mendes Department of Physics, Stockholm University Box 6730, S-113 85 Stockholm, Sweden
ABSTRACT
The influence of rock heterogeneity on contaminant migration is analysed in a Monte Carlo study of transport of Technetium in fractured media. The CRYSTAL3D model developed to address heterogeneity in Monte Carlo transport calculations has been used for this purpose. CPU and memory requirements of this model made it necessary to make use of high-performance computing. Therefore a Monte Carlo driver implemented on a parallel supercomputer has been used to monitor the CRYSTAL3D model. The results of a sensitivity analysis show that the impact of the geometry of the media on the consequence distribution, expressed in this model by the F-ratio number, is a very important parameter. It is also concluded that it is not possible to evaluate the importance of the wet surface area by intercomparision of case simulations with this parameter as the only feature that distinguishes those cases. Therefore, to be able to complete the study of the impact of heterogeneity of fractured media on the estimation of consequences from Monte Carlo calculations of radionuclide transport, it will be necessary to introduce in the parallel driver the ability to sample the wet surface area and the Darcy velocity parameters.
KEYWORDS Radioactive waste, fractured media, heterogeneity, sensitivity analysis, parallel computing.
1. INTRODUCTION In performance assessments of underground radioactive waste repositories it is common to consider the system to be simulated as comprising of three compartments. The first one is the near-field which includes the repository with its tunnels, shatts and silos i.e. the engineered barriers and also the environment adjacent to those barriers. The second compartment is the far-field, a natural barrier formed by the surrounding rock which delays the transport of most of the radionuclides leaving the near-field and finally the third compartment is the biosphere. This paper focuses on some aspects of heterogeneity of fractured media (the far-field) in the way it is handled by models adequate for Monte Carlo simulations. To achieve our goal we have applied the CRYSTAL3D model, Andersson et al (1997), to perform a variation study of some far-field parameters and to analyse their influence on the transport of Technetium-99. This nuclide is one of the most important 585
A. Pereira et al.
586
species of high-level radioactive wastes (HLW), due to its mobility in the aqueous phase and its complex chemistry. The CRYSTAL3D model simulates radionuclide transport pathways between the near-field and the biosphere. Each pathway is formed by fractures connected in series. The fractures are generated stochastically within a given volume defined by the code user. Two geometric properties of those fractures are sampled from probability density functions (pdJ~) given as input to the model. Those properties are the lengths of individual fractures and their orientation in space. The fractures are characterised not only by their geometric properties but also by chemical and physical properties, for instance sorption on fracture walls, matrix diffusion, longitudinal dispersion, wet surface area, etc. These properties are also sampled from pdfs. The variation of these properties along the pathway forms the mechanism used in CRYSTAL3D to model the heterogeneity of the fractured media. CRYSTAL3D calls the CRYSTAL model as a subroutine (see section 3).
2. THE P A R A L L E L MONTE CARLO DRIVER The stochastic sampling is done by a parallel Monte Carlo driver, now under development for the European project GESAMAC. This driver enables one to perform probabilistic assessments or limited parameter variability studies, by sampling parameters from pdfs. The fundamental choices done by the user when running the code concern the number of variables that are to be sampled from pdfs, the number of samples, the sampling technique to be used and the models to be coupled to the driver for use in the simulations. The basic conceptual structure of the parallel driver is shown in Figure 1. Its simplicity arises from the fact that it incorporates transport calculations that are independent.from each other.
@ @
@ ...
@
Figure 1 SPMD model of the parallel driver The circles represent the different machine nodes. Node In reads input data, samples the parameters from different pdfs and generates the input matrix of all parameters. This matrix is scattered to nodes N1, N2, etc. All nodes now work independently of each other with the same transport code. The final results are gathered by node Out and printed to output files in a convenient way for statistical post-processing. Thus, there is no communication between nodes N1, N2, etc. which minimises communication costs; it is because of this that we expect this single program multiple data model (SPMD) to be the most suitable one for our M.C. driver. The generation of random numbers at only one node proved to be a good strategy because it is sufficiently fast and avoids the introduction of spurious correlations between parameters, which is not uncommon without a sophisticated parallel random number generator. It is also important in some cases to deliberately introduce correlations between geological parameters. Here once again, it is very useful to have the whole matrix of sampled parameters in only one node, before calling the correlation subroutine to introduce the desired dependencies between the parameters.
587
Advances in Safety and Reliability: ESREL '97 3. T H E T R A N S P O R T O F T E C H N E T I U M IN F R A C T U R E D M E D I A The migration of Tc-99 in the far-field is, in CRYSTAL, Robinson of advection/dispersion and is modelled by following equations: _3 Ot
et al
(1992), described by the mechanism
o (Cm;) (ORici)+ V(qci)_V(ODLCi ) =/~i_,ORici_, _/],iORi¢i +aOmDm OWw
0 (RmiCmi): Om 022 (Cmi).]_/~i lORmil Ot '- Cm'i-1 ~['iORmiCmi OWW
-
w = 0
(1)
(2)
--
with:
Ri = 1 +
Rmi = 1 +
K d i P m (1
KdmiPm
Om)a~
-
(1
-
Om)a~
and where: i - index representing the i th nuclide in a decay chain c i - concentration of nuclide i in water flowing in the fractures [moles/m 3] Cmi - concentration of nuclide i in matrix pore water [moles/m 3] w- maximum penetration distance, perpendicular to the fracture [m] D L - longitudinal dispersion [m/s] a - specific wet surfacearea (per volume of rock mass) [m -1] 0 - rock mass porosity 0 m - matrix porosity D m - matrix diffusivity [m2/s] q - groundwater flow or Darcy flow [m3/m2/s] K d i - distribution coefficient on the fracture surface of nuclide i [m3/kg] R i - retention coefficient on the fracture of nuclide i K d m i - distribution coefficient in the matrix of nuclide i [m3/kg] Rmi - retention coefficient in the matrix of nuclide i ')]'i - decay constant of nuclide i [s -1] /am - density of rock matrix [kg/m 3] Because we are focusing on the far-field we have not simulated the transport in the near-field, i.e. the leaching process from the canister and the subsequent transport of Tc-99 through the bentonite and the rock layer adjacent to it. We assume instead an hypothetical source term to describe the input to the far-field model and which is the same as the one used in Andersson e t a l (1997).
4. CASE STUDIES The transport of Technetium in the far-field is assumed to be under reducing conditions. Three case studies are defined by the variation of the wet surface parameter which assumes three distinct values, one for each case simulation. C a s e I corresponds to the lowest value of wet surface area in Table 1 and c a s e I H to the highest value. Fracture lengths are assumed to vary between 1 and 10 meters. These lengths are distributed according to a uniform p d f The distance between the far-field inlet and the biosphere is 100 meters. The inlet area is l m 2 and the outlet area 100m 2 . The half-life of 99Tc is 2.13 x 105 years. Remaining geosphere
588
A. Pereira et al.
parameters and the pdfs from which their values are sampled are also shown in Table 1. The wet surface area cannot, in the actual version of the parallel driver, be sampled from a p d f and therefore we have defined the three case studies by means of the three values of that parameter shown in Table 1. The groundwater flow rate or its equivalent the Darcy velocity q, cannot be varied along the transport pathway by mass conservation reasons associated to limitations of the CRYSTAL model.
5. RESULTS It is not feasible to run the CRYSTAL3D model in a normal computer due to CPU-time, diskstorage and memory requirements. The large amount of generated output data is also a downside of this model and although we had access to a parallel supercomputer for the simulations, we found it necessary to limit for each of the three cases, the number of samples to one thousand. The real limitations were those associated to the statistical software capabilities of our local workstation at the present moment, which do not allow us to perform sensitivity analyses on data from very large simulations. B y t h e same reason we have reduced the distance between the inlet and outlet areas from 500 meters to 100 meters which implies a lower number of fractures for each pathway and consequently a manageable amount of data used in the analysis.
TABLE
1
PARAMETER DISTRIBUTIONS USED IN THE PROBABILISTIC CALCULATIONS Param.
Unit
pdf.
D L
[m2/y]
Logunif.
q
[m/y]
W
[m]
Dm
ImPly]
Const. t Uniform Const.
[m "l]
Const. Const. Logunif. Const. *
0 0m
R a
Min '
Mean
Max.
1.2 × 10-4 1!
0.05
1.0 1.6 x 10-3 1.0x 10 -4 1.0 x 10- 3
0.43
2.83 10-2,1.6 x 10-2,10 -1
t The Darcy velocity is kept constant. The wet surface area is equal to 10 -2,1.6 x 10 -2,10 -1 [ m-1] for cases 1, H and 111 respectively.
5.1
Uncertainty Results
The total length of each pathway is distributed according to the histogram show in Figure 2a. Their length varied between 119.3 and 180.5 meters. The mean value for the pathway length is 141.9 meters. The distribution resembles a normal one, but a normality test has not been done upon the data. The difference between the peak releases for the three cases is insignificant and is motivated by the sensitivity analysis of the next section. Figure 2b shows therefore only the distribution of peak releases for case II.
5.2 Sensitivity Analysis In safety assessments of radioactive waste, peak releases are a very useful consequence measure. We have used here peak release rates expressed in [Bq/y] which implies, from the sensitivity analysis (S.A.) point of view, that we should examine the impact of geosphere parameters on these peak release rates.
Advances in Safety and Reliability: ESREL '97
589
One of the consequences of the averaging of properties along transport pathways, is a characteristically smaller variance of the output distribution if compared with corresponding distributions delivered by models which do not consider the effects of heterogeneity of fractured media in Monte Carlo simulations. This fact implies in turn, that we do not need to rely on rank based sensitivity analysis to obtained sensitivity values that are statistically significant. We have therefore used Pearson correlation coefficients to order the variable parameters or parameter groups according to their influence on peak release rates for the three cases. The above mentioned groups of parameters that we have considered are the Peclet number and the F-ratio. These numbers are given by: Pe=qL/OD
(3)
L
(4)
F = a L/q
In our case the variation of the F-ratio is equivalent to the variation of the total path length L because the wet surface area a and the Darcy velocity q were kept constant.
78 72 66 60 54 48
£ ~ ~/ ~/~,~ ~,,/ ~ ~I ~ ~~ ~ \ ~,~
~ 36
~ ~
z 30
~
~ ~,~,~,~ ~,
24
~.~~
0 121.0 128.0 136.0 143.0 151.0 159.0 166.0 174.0 182.0 Pathway length [m]
1.34E+07 1.39E+07 1.44E+07 1.50E+07 1.55E+07 Peak release[Bq/y]
Figure 2. The distribution of the pathways (left) and Peak release rate in [Bq/y] of 99TC (fight). The release rates of 99Tc regardless of its time of occurrence (peak releases) for the three cases here studied, are presented in Table 2.
TABLE 2
CENTRAL VALUES FOR THE RELEASE RATE REGARDLESS OF TIME IN [Bq/y]
Peak release stand, dev. min.
max. confid. -95% confid. +95%
Case I
Case II
Case III
1.48 x 107 4.07 x 105 1.32x 107 1.60× 107 1.484 x 107 1.489 x 107
1.46 x 107 4.43 x 105 1.28x 107 1.57 x 107 1.453 x 107 1.459 x 107
1.21 x 107 7.29 x 105 9.45 x 106 1.41 x 107 1.208 x 107 1.217 x 107
Each set of pathways in our three simulation cases are formed by fractures in series, so it is not obvious how to define a one to one relation between the parameters and the peak releases for the purpose of performing a sensitivity analysis. We have chosen to compute, for each pathway, the median of the fracture parameters, with the exception of the fracture lengths which is an additive parameter; therefore in this case the value of
590
A. Pereira et al.
L for each realisation is equal to the sum of lengths for each fracture. Table 3 shows the results obtained using the Pearson correlation coefficients. From Table 3, we can rank the geosphere parameters in decreasing order of importance as" F-ratio >> R >> P e >> w >> D L
The F-ratio is the most important parameter followed by the retention coefficient, the Peclet number and the wet surface area. The longitudinal dispersion is not a relevant parameter.
TABLE 3
PEARSON CORRELATION COEFFICIENTS BETWEEN GEOSPHERE PARAMETERS AND PEAK RELEASE RATE
DL w R Pe F-ratio
Case I
Case II
Case III
+0.09 -0.33 -0.42 -0.34 -0.53
+0.09 -0.31 -0.46 -0.33 -0.73
+0.14 -0.28 -0.56 -0.34 -0.60
All values are significant at 95% confidence level
For all but the longitudinal dispersion D L , the parameters show at 95% confidence level, an anti-correlation with peak release rates, i.e. lower parameter values result in increased release rates. Due to the dependence on the total fracture length L, the F-ratio and Peclet numbers are closely related in our model to the geometry of the fractured media. The rank of those parameters reflects that the average of properties along the transport pathways (i.e. the heterogeneity) has important consequences on the output distribution. The scatter plots of Figure 3 illustrate the correlation patterns between peak releases and parameters for case I. The scatter plots for the other cases are very similar. The ellipses are the bounds of the 95 % confidence levels. The physically important F-ratio and Peclet numbers can be used in cases of deterministic variation studies to cover the parameter space that results in higher release rates, by an appropriate choice of the parameters that define those quantities. For instance for the case ofF-ratio, a high Darcy velocity and a low wet surface parameter result, for a given transport length, in a high release rate but doubling the wet surface area a and the Darcy velocity q results on the same F-ratio and could be discarded as a new variation case. Considering that the difference between the three cases rely on the wet surface area a, we conclude that the span of one order of magnitude between the lowest value of a (case I) and the highest one (case III) is not reflected in significant differences between the peak releases. There are two main reasons for the, apparently low importance of the wet surface area parameter a, in the far-field transport of 99Tc. The first one is that it varies between 1 cm and 10 cm which in combination with low penetration depths (between 0.05 meters and 1 meter) and the low K d values of Technetium represent a low buffer capacity for the rock. Therefore the crystalline rock functions in practice only as a delay barrier and not a buffer ~. The second reason has to do with the approach used here, which illustrates the need to be very careful in the interpretation of S.A. results. In fact, one must distinguish between the impact of parameters within a simulation case and between simulation cases. The wet surface area has been varied between cases, but if it had been possible to vary it within each of the three cases, it had been shown to be an important parameter, t The reader should observe that, on the absence of experimental data, the interval for the variation of w is hypothetical and probably conservative.
Advances in Safety and Reliability: ESREL '97
591
i.e. the correlation value between the peak release and the parameter a should be relatively high (according to previous experience); this argument is reinforced by the observation that the variation between cases of the Pearson correlation coefficients for the first three parameters in Table 3 is insignificant and it is therefore ex1.62e7
1.62e7
1.58e7
1.58e7
"~ 1.54e7
'~ 1.54e7
" 1.5e7
1.5e7
1.46e7 ~
1.42e7
•
1.46e7 "~'~:;.zz
:'7/.
÷
.
1.42e7
~ 1.38e7
~ +
1.34e7 1.3e7 -20
/,
0
.. 20
1.38e7
"~?.Vr;a;_ ÷
1.34e7 40
60
80
100
120
140
160
1.3e7 500
1500
Retention coefficient
1.62e7 I 1.58e7
*//~ * ~ - ,
~-+-~•,
•
•
÷ ÷
2500
3500
Longitudinal dispersion
1.62e7 [ 1.58e7 [
*
~,~*** ~ 1 ~ ~ * , ~, ~ -~-~-~
1547 i
1.34e7 1.3e7 0.05
1.34e7 0.15
0.25
0.35
0.45
Penetration depth
0.55
0.65
0.75
1.3e7 300
÷
350
400
450
500
550
600
650
700
F-Ratio
Figure 3 Scatter plots of peak release rate of case II versus parameters. pected that if we had varied the parameter a by sampling it from a distribution and instead based the three cases by keeping for instance the retardation coefficient constant within each case, we should observe a similar behaviour to that of the parameter a. In summary, for the case of transport of Technetium and using the data set of Table 1 we cannot exclude that the wet surface is a less relevant parameter than the other geosphere parameters.
6. S U M M A R Y AND CONCLUSIONS We have applied the CRYSTAL3D model to introduce heterogeneity in Monte Carlo calculations of transport of Technetium in geosphere. A Monte Carlo driver implemented in an IBM-Sp2 parallel supercomputer was used to monitor the CRYSTAL3D model. Due to limitations in the actual phase of this project, in the examination of large amounts of data we found it necessary to reduce the number of variable parameters to four and the number of fractures per pathway to 23 in average. The Darcy velocity was kept constant in all simulations. To vary the wet surface area, three case studies were constructed, using three different values for this parameter. It was observed that the impact of this parameter on the peak release rates could not be conveniently extracted by this procedure. For the data set used in this paper, the distribution of the release rates shows a relative small variance. Probably the output distribution of peak releases would display a higher variance if the Darcy velocity had been varied between realisations, due to a spread in water transit times. The calculations indicate that the geosphere environment acts in the case of migration of Technetium only as a delay barrier and not as a buffer. The magnitude of the mean peak release is practically the same as the
592
A. Pereira et al.
peak of the source term. The S.A. analysis shows that (in absence of variation of the Darcy velocity) the Fratio is the most important parameter. It will be necessary to include the variation of the Darcy velocity and wet surface area to be able to draw definite conclusions on the impact of heterogeneity on the estimation of the release rates by means of the CRYSTAL3D model. Another improvement needed for the near future is the development of dedicated software that can cope with statistical post-processing of large amounts of data and allow the visualisation of these results. We conclude also that the SPMD model is by its simplicity and transparency a good option for Monte Carlo calculations using 1D transport codes.
ACKNOWLEDGEMENTS The authors thank the Swedish Nuclear Power Inspectorate for support to our work in the field of radioactive waste management. The European Commission is also gratefully acknowledged for financial support to develop the parallel drive as part of the GESAMAC project (contract F14W-CT95-0017), within the frame of the R&D program of"Nuclear Fission Safety" (1994-1998).
REFERENCES
Andersson, M., Mendes, B., and Pereira, A. (1997). The Impact of Heterogeneity of Fractured Media in Monte Carlo Assessments of High-Level Nuclear Waste. (to be printed in the proceedings of the WM'97 conference, Tucson, Arizona, USA.) Robinson, P. and Worgan, K. (1992). CRYSTAL: A Model of a Fractured Rock Geosphere for Performance Assessment within the SKI Project-90. SKI Technical Report 91:13, Stockholm, Sweden.
EXPLORING THE POTENTIAL FOR CRITICALITY IN GEOLOGIC REPOSITORIES FOR NUCLEAR WASTE Rob P. Rechard Nuclear Waste Programs Center Sandia National Laboratories Albuquerque, NM 87185-1328
ABSTRACT Arguments on criticality in a geologic disposal system can be grouped according to the two main aspects of risk: probability and consequence. Within the probability category, this paper suggests that the arguments be organized by physical, hydrologic, and geochemical constraints, which correspond to the main disciplines involved in exploration of the criticality issue (i.e., nuclear engineers, hydrologists, and geochemists). The arguments can then be further subdivided according to location within the disposal system (e.g., at container, near container, or in far field), with time used as a final subdivision, if necessary. Heuristic arguments for this approach are presented, followed by examples of specific arguments used in support of the potential repositories at the Waste Isolation Pilot Plant (WlPP) and the Yucca Mountain Project (YMP) in the United States, which demonstrate the difficulty of creating conditions conducive to criticality within a nuclear waste geologic disposal system. KEYWORDS Criticality, nuclear waste repository, highly enriched spent nuclear fuel, risk assessment, performance assessment, Waste Isolation Pilot Plant, Yucca Mountain Project, radioactive waste disposal, uncertainty analysis. INTRODUCTION
Like any surface facility that handles fissile material, a geologic disposal system for nuclear waste must be assessed for the probability and consequences of a sustained, nuclear chain reaction (i.e., criticality). In the United States, criticality has been listed as an event to be considered in scenario development since 1979 (Bingham and Barr, 1980); since 1981, the International Atomic Energy Agency (IAEA) has listed criticality for consideration in its guidance to member countries siting nuclear waste repositories. Over the years, the potential for criticality has been examined for two projects in the United States: (1)the Waste Isolation Pilot Plant (WlPP), a facility built for the disposal of waste contaminated with transuranic radioisotopes created during manufacture of nuclear weapons, and (2)the Yucca Mountain Project (YMP), a possible repository for commercial and defense high-level waste and spent nuclear fuel. Because of the diverse scientific disciplines required, studies on criticality in geologic disposal systems often describe only one aspect of the criticality issue rather than their interaction. For example, Allen (1978) reported on the size of spherically shaped critical masses of actinides while Brookins (1978) described several geochemical constraints on accumulating critical masses of actinides in geologic repositories. 593
594
R.R Rechard
Recently, Rechard et al (Rechard, ed., 1993; 1995; Rechard et al, 1996; 1997) explored the criticality event in salt (WIPP) and tuff (YMP) repositories. For both the WIPP and the YMP, the studies have evaluated whether the criticality event (or processes leading up to criticality) should be included in general scenarios or whether it can be omitted based on low probability and/or low consequence. This paper reviews the approach used in the latter papers and shows some typical results. PERFORMANCE ASSESSMENT The approach described is part of the general process of assessing the performance of a geologic disposal system in the United States. The overall risk analysis process for a nuclear waste disposal system is usually called a performance assessment; it assesses whether a waste disposal system meets a set of performance criteria.
Performance Criteria The current standard by which the probability and consequences of criticality are assessed in the United States is the U.S. Environmental Protection Agency (EPA) standard, 40 CFR Part 191--Environmental Standards for the Management and Disposal of Spent Nuclear Fuel High-Level and Transuranic Radioactive Wastes. Although 40 CFR 191 lacks specific guidance regarding the occurrence of criticality after closure of a repository, any risks associated with a critical condition are evaluated under the general provisions of the standard. The primary provision is the Containment Requirements, which require an analysis to evaluate probabilities of cumulative release at the disposal system boundary over 10,000 yr and compare the results against the numerical criterion of 40 CFR 191. The U.S. Nuclear Regulatory Commission is responsible for implementing a future EPA standard for YMP and will likely clarify the type of criticality control or the type of calculations required to demonstrate a low level of criticality risk after repository closure (i.e., low probability or low consequence); the expectation for the latter is that low probability will be emphasized. Criticality as an Event
To determine the probability and consequences of an unwanted occurrence, the disposal system must be characterized and mathematically modeled. In an abstract sense, this characterization determines the parameter space of the conceptual model of the disposal system. The parameters can be succinctly symbolized as D = [x~,x2.... xne] where nP is the total number of parameters of the model of the disposal system and the parameters are descriptors of various features, events, and processes of the disposal system (Rechard, 1995). For example, some of the parameters may define conditions important to criticality. In analyzing the risk of a critical condition developing in a repository, two approaches can be used. The first approach treats a critical condition as an event and develops scenarios that contain this event. In an abstract sense, the process of forming this scenario consists of assuming criticality and thereby focusing on a subset not including those parameters unique to criticality. The process of forming scenarios focuses attention on a particular aspect of the system being modeled. Forming scenarios can also help screen out particular features, events, and processes of the disposal system that do not influence the outcomes under study. In addition to evaluating consequences, this approach requires that a probability be assigned to the criticality event, a difficult process because the scenario is composed of natural processes. Although the probability of a natural process occurring may be high (i.e., corrosion of a container), whether the process will induce conditions that promote critical condition is not easy to discern. Furthermore, the probability of natural processes occurring changes with time (e.g., from climate change). However, despite the difficulties, bounding calculations on probability and consequences can be useful in conveying the arguments to a wide audience.
Advances in Safety and Reliability: ESREL '97
595
The second approach fully simulates the evolution of the disposal system as the container degrades to monitor whether conditions exist under which a criticality could occur. This approach permits a better understanding of the phenomena necessary to promote a nuclear chain reaction in a repository and the likely initial and boundary conditions for criticality (see Rechard, ed., 1995). A drawback to this approach is that the modeling is complex and thus difficult to convey briefly.
PROBABILITY OF C R I T I C A L I T Y EPA guidance in 40 CFR 191 (Appendix C) allows the omission of categories of features, events, and processes with probabilities of occurrence of less than 10-4 in 10,000 yr. Therefore, if the probability of all scenarios containing the criticality event is less than 10-4 in 10,000 yr (i.e., P[Sj} < 10-a), then the criticality event can be omitted. Given that probabilities of events that make up a scenario Sj are independent, any scenario containing a criticality event is less than 10-4 if the probability of criticality is less than 10-4. For example, if P{Sj} = P{HI}.....P{C}, then P[Sj}< 10-4 if P[C] < 10-4, where P[HI} is the probability of inadvertent human intrusion event and P{C} is the probability of a criticality event.
Factors of Probability Assuming independence of conditional factors, the probability of criticality is the conditional probability times the probability that physical, hydrologic, and geochemical constraints are satisfied. That is, P[C} = P{C Ip n h n c} op[p}.P{h}. P[c}, where P{C lp n h n c} is the conditional probability of criticality given no physical, hydrologic, or geochemical constraints (equal to 1 if all necessary conditions are factored out), Pip} is the probability of no physical constraints, P[h} is the probability of no hydrologic constraints, and P{c} is the probability of no geochemical constraints to criticality. This simple abstract view of the probability of criticality permits arguments to be conveniently organized with regard to arguing the possibility or impossibility of criticality in a nuclear waste repository. This approach is convenient particularly because the contributions of various scientific disciplines are readily apparent.
Example of Estimating Probabilities To demonstrate the application of the approach, a few examples of arguments used in support of performance assessment for the WIPP and for work related to disposal of highly enriched spent nuclear fuel at YMP are presented. The examples evaluate the probability of each of the three factors that comprise P[C}. (In practice, the author also categorizes arguments by location.)
Probability of Physical Constraints Criticality depends on the neutrons and their interaction with matter; hence a critical condition depends not only on the quantity of fissile material but also on its concentration and shape and any other material mixed with or surrounding the fissile material either as a solid (e.g., containment vessel), liquid (e.g., solvent), or gas that reflects or absorbs the neutrons. The temperature of the material also has an important influence. In describing the possibilities of fissile material mixtures, the behavior of fissile material with water is most often presented as the fissile mass versus the fissile concentration. A common curve shape for this relationship is represented by a 239pu-H20 mixture. For criticality to occur, the mass must be greater than 0.5 kg and the amount of 239pu mass in a unit volume of material must be greater than 7 kg/m 3 (-7000 ppm) when pure water is the primary interactive (moderating) substance and the other substances are fairly transparent to neutrons (Figure la). For a mixture of 239puO2, dolomite (porosity[~]=16%), and brine, or a mixture of 239pu and tuff, this concentration limit for criticality is --3 kg/m 3 (3000 ppm) (Figure la). Hence the solid concentration of plutonium or uranium (Figure l b) must reach levels that are considered to be economically mineable ore bodies (>--1000 ppm for uranium when located near the surface). The criticality limits for various geologic material presented here are based on calculations made with MCNP TM (Monte Carlo code for Neutron and Photon transport [Briesmeister, ed., 1986]).
596
R.R Rechard
The maximum fissile mass collected in geologic media depends on time (e.g., rates of fluid flow carrying and depositing fissile material) and so depends upon the regulatory period, unless a geometrical constraint on the maximum mass or volume exists. Hence, the minimum critical mass is not always a useful criterion in geologic media. In contrast, the limiting concentrations of plutonium and uranium can be easily compared with various solid concentrations possible through natural phenomena such as dissolution, adsorption, and precipitation. For example, using data from an assessment of the WIPP performed in 1996, a solution of pure 239puO2 at a concentration of 3 kg/m 3 corresponds to 12 mM, a concentration 30 times greater than the maximum solubility of Pu(IV). Similarly, a solution of pure 235UO2 at a concentration of 10 kg/m 3 corresponds to 37 mM. Consequently, a solution of either dissolved plutonium or dissolved uranium cannot go critical in the repository or elsewhere. Rather, the dissolved fissile material must be concentrated through adsorption and precipitation, for example.
Probability of Geochemical Constraints Once the fissile mass leaves a repository, the general tendency is for the radionuclides t9 disperse rather than concentrate. Within the WIPP disposal system, five mechanisms conceivably exist to cause a concentration of fissile material in one location: concentrated solution, compaction of waste, adsorption on mineral surfaces (e.g., ion exchange or surface complexation), filtration of colloid material, and precipitation. However, no special features exist to make these mechanisms feasible. Below is an example showing the probability of adsorption by itself, P[c}, that is clearly less than 10-4 such that P[C} is also less than 10-4. One condition upon which the potential for criticality from adsorption of uranium depends is the density of adsorption sites on dolomite. The amount of adsorption that can occur in a volume of Culebra dolomite at the WIPP is limited. An adsorbed uranium concentration of 1'0 kg/m 3 corresponds to 2.5 x 107 atoms/nm 2 of dolomite. The measured surface area on a carefully crushed and lightly acid-washed sample of dolomite from a shaft at the WIPP, as evaluated by surface area analysis, was 620 m2/kg dolomite and corresponds to 1.5 × 106 m 2 of surface area per m 3 of dolomite (assuming a porosity of 16% and dolomite grain density of 2820 kg/m3). Dividing the adsorbed uranium concentration by the surface area gives a site density of --17 atoms/nm 2. Although this site density is of the same order of magnitude as synthetically prepared goethite (~-FeOOH), a very effective adsorbent, most highly adsorptive minerals have much less adsorptive capacity (about 2 sites/nm 2) (Rechard et al, 1996). More importantly, the uranium at the WIPP is only -5% enriched (initially) and so the available adsorptive sites are much more likely to be filled with 238U than 235U. To get 10 kg/m 3 (Figure 1) of 235U at 5% enrichment would require 333 sites/nm 2. Thus, obtaining the critical concentration requires more than the entire sorptive capacity of a highly adsorptive material (of which the dolomite at the WIPP is reasonably bound).
Estimate of Conditional Probability Rechard et al (1997) present an argument for evaluating the conditional probability of P{CIp n h n c} • P{h}, i.e., the probability is conditional on the presence of proper geochemical conditions (such as strong oxidizing source, few other materials [e.g., other actinides] that readily absorb neutrons being coprecipitated with the fissile material) and proper physical conditions. Portions of this argument are presented below. The only known empirical basis for determining a rate of formation of a critical mass in nature is the number of uranium sites in the world that have gone critical. The -. 16 reactor zones of the Oklo ore deposit and a few reactor zones in other ore deposits in the Francevillian basin in Gabon, Africa, are the only sites known to have gone critical. One item of potential use is a rough estimate of the "efficiency" of nature in collecting fissile material in a critical condition as the result of strong reductants in a localized area. At Oklo, the rate of formation of the reactors is unknown, but the upper bound is the time required to form the uranium rich layer, --3 × 107 yr (2.00 × 109 yr minus 1.97 × 109 yr). The lower bound is possibly the minimum operating
Advances in Safety and Reliability: ESREL '97 10 4
-_ _ _
WIPP inventory of 239pu
_
Pu/Tuff 12%
10 a
~/~ '~ ".
O
"E. 0
10 2
\
•
Pu/Halite/brine 1.3%
~
\~" J PuO2/Culebra/brine ~ = 16%
_.
597
,J
euO2/Tuff/J-13 ~ = 12% /
/ ~
/Pu/Culebra/brine= 16% _
~_.:_.,_ -
_
../"
-
n
O3
_ o
~
s
S~'S
101
0 ~
c"
~
Limit J Concentration for which Criticality impossible
10 o
10-1
•. ~ . . . . .
.o
Pu/H20 (experimental)
101
10 2
10 3
(a) 239pu C o n c e n t r a t i o n !
10 4 E)3 v
(13 o
o ~
10
10
i
i
i iii
I
........
I
........
~
I
', t " t ' ~
t
ra
I
........
I
.......
.,te
~
"1
:
uo2 co2/5%
"i ~ ~
10 1
( k g / m 3)
........
' l l ~ 235U/Culebra }~~ / b r i n e saturated " / ~ = 8%
2 L
I
10 S
10 4
.-=
UO 2 CO 2/5% 235U/Culebra /brine saturated
3
0 ~
i
WlPP i n v e n t o r y of 235U
_
10 0
10-1
~"
UO/Tuff/J-13 2 s SS
~
Tuff/J-13 , . - ._. .
\4n,. 1Or
]
W /
s SS
Z-""
.
0 L _
c-"
10 0 _ _
_
(experimental)
_
_
10-1
. . . . . . . .
10-1
I
10 o
. . . . . . . .
I
10 ~
. . . . . . . .
I
. . . . . . . .
10 2
(b) 23sU C o n c e n t r a t i o n
I
. . . . . . . .
10 3
I
10 4
. . . . . . .
10 s
( k g / m 3) TRI-6342-4836-1
Figure 1. Critical masses of fissile material in a spherical shape as a function of fissile concentration when mixed with various substances and reflected by the same substance without fissile material (after Rechard et al, 1996). (a) Critical mass of 239pu at 100% wt. (b) Critical mass of 235U at 93.2% wt. unless noted otherwise.
598
R.P. Rechard
life of the reactors, -2 x 105 yr. Furthermore, the six zones for which data exist involved -800 metric tonnes of uranium (heavy metal) (MTHM). Thus, the maximum formation rate is -3.75 x 10.8 events/yr/MTHM (6 events/[800 MTHM • 2 x 105 yr]). At the YMP, this rate is conditional on a container of waste being under a dripping fracture and more infiltration occurring through the mountain than is thought now to occur. In these calculations, the spacing of the potentially wet fractures was -25 m, which is a frequent spacing of wet fractures in the E and O tunnels that are located under Rainier Mesa at Yucca Mountain (Rechard et al, 1996). With a fracture spacing of 25 m and a container length of 5 m, approximately 20% of the containers would eventually fail from wet fractures. At the YMP, the majority of fuel is expected from commercial power reactors. However, YMP may accept some U.S. Department of Energy (DOE) fuel and high level waste; of the latter waste, only the highly enriched uranium spent fuel (210 MTHM) is likely to exhibit a tendency to go critical. Therefore, the rate of formation, r(t), is a constant and equal to 1.6 x 10-6 events/yr (0.2 • 210 MTHM • 3.75 x 10.8 events/yr/MTHM). To be consistent with 40 CFR 191, the probability in the first 10,000 yr is determined. The probability model is based on the failure-rate function defined by r(t) = -d/dt In[l- F(t)], where t is time elapsed since the disposal system was closed and F(t) denotes the cumulative distribution function for the first time, T, when failure occurs (i.e., F(t) = P{T < t]). This equation can be integrated to give (1)
F(t) = 1- exp(- j" r(x)dx )
In the first 10,000 yr, however, the containers must first fail and then any boron in the containers must be separated from the uranium, which requires at least 7300 yr to occur (described in Rechard et al, 1997). Integrating Eqn. 1 from 7300 to 10,000 yields a probability of 4 x 10-3 for c~ h n c} eP{h}.
P{CIp
CONSEQUENCES OF C R I T I C A L I T Y If the consequences are negligible, then a basis is established for neglecting the criticality event. For criticality to be important after closure of the repository, assuming that a criticality could occur, it would have to either (1)degrade the ability of the disposal system to contain nuclear waste by generating significant amounts of kinetic or additional heat energy or (2) produce more hazardous waste than originally present such that dose at the accessible environment is greater. Following are examples of estimating consequences.
Beneficial Burn-Up of Plutonium at W I P P In general, the consequences of a 239pu criticality at the WIPP are beneficial because, after about 100 years following criticality, the fissioning produces fission products with fewer EPA units (a surrogate for health risk) than those present prior to the criticality (Table I).
Bounds on Total Energy (Fissions)at YMP Accidents and experiments of moderated and unmoderated fast rates of assembly release similar amounts of energy (as represented by fissions), between 1015 and 1020 fissions (Rechard et al, 1997). These incidents provide an empirical bound on the energy release from a criticality event because in an unsaturated repository, the criticality is assumed to occur at atmospheric pressure with a breached container. Here we assume a maximum number of fissions per event of 1020 and a rate of one event per day (defended below). Consequently an increase in inventory of radionuclides from one critical event of 1020 fissions would be negligible. One critical event occurring every day for 10,000 yr would amount to -1025 fissions and one critical event occurring every day for 1 million yr would amount to -1027 fissions. For comparison, a 70,000-MTHM YMP repository of spent fuel with burn-up of 40,000 MWd/MTHM would represent on the
Advances in Safety and Reliability: ESREL '97
599
TABLE I. SUMMED EPA UNITS VERSUS TIME BASED ON RELEASELIMITS (SURROGATEOF HEALTHRISK) IN 40 CFR 191 FOR FISSIONPRODUCTSOF 239pu (RECHARDET AL., 1997) Time(yr)
Summed EPA units offission products
0
1.000
0.003
11.179
10
8.8538
100
1.1047
110
0.8794
1000
0.0004
10000
0.0003
order of 1031 fissions. Thus, one critical event per day for 1 million yr (1027 fissions per container) is only 0.01% of the fission inventory represented by a 70,000-MTHM repository.
Increased Heat at YMP
The thermal energy released from criticality at YMP would be small since the fissile material would be at atmospheric pressure (Rechard et al, 1997). Thus the maximum temperature during the criticality event would be below 373 K in order to maintain the presence of the water moderator. This maximum temperature is used to determine the rate (power) of approximately 1 criticality event/day as follows. Assuming the power input must equal the radiative energy transfer from the surface of the cylindrical container through the air gap to the surface of the tunnel yields a steady-state power, Q, Q = 2rtrt (y(T4w- T4t)/[1/ew + (r/R) 2 (1/Et-1)] = 13 kW --- 1020 fissions/day
(2)
where r is radius of container (0.885 m), R is radius of tunnel (2.15 m), Tw is absolute temperature of container surface (373 K), Tt is absolute far-field temperature of tuff (303 K), e is container length (5.1 m), G is Stefan-Boltzmann constant (5.67 x 10-8 W/(m 2 K4)), Et and ew are total emissivity of oxidized carbon steel container and tuff at 100°C (0.8). In reality, the container would be corroded and the fissile mass would be on the tunnel floor but the approximation is consistent with the rough estimates. For the DOE fuel and high level waste in the YMP repository (Rechard, ed., 1995), the thermal energy in the year 2030 would be --4000 kW. Hence, the 13 kW/container thermal energy produced is less than 1% (per container) of the thermal power normally produced from radioactive decay of DOE fuel and high level waste. SUMMARY
Criticality in a nuclear repository can be examined either through simulation or as an event that then becomes part of various scenarios. Although the author has applied both approaches, the latter approach is discussed here. In presenting arguments about the possibility or impossibility of criticality when expressed as event, the author has found it convenient to organize the arguments according to the two main aspects of risk (probability and consequences), further categorizing the probability grouping by its components based on pertinent phenomena as follows: Risk {Crit }
= P { Crit }. C { Crit } = P {Crit [ phy n hydro n chem }. P {phy }.P{ hydro }.P {chem }. C {Crit }
600
R.R Rechard
These components can be further divided with regard to location within the disposal system (e.g., at the container, near the container, and in the far field). This simple approach is useful primarily because the scientific disciplines necessary to examine the criticality issue are easily distinguished. Although transferring information between disciplines remains a challenge, discussing criticality limits in terms of concentration has proved useful in information exchanges because fissile material concentration is more clearly dependent on geochemical processes than absolute mass.
REFERENCES Allen, E.J. (1978). Criticality Analysis of Aggregations of Actinides from Commercial Nuclear Waste in Geological Storage, ORNL/TM-6458. Oak Ridge National Laboratory, Oak Ridge, TN. Bingham, F.W., and Barr, G.E. (1980). Development of Scenarios for the Long-Term Release of Radionuclides from the Proposed Waste Isolation Pilot Plant in Southeastern New Mexico. Scientific Basis for Nuclear Waste Management, Proceedings of the International Symposium, Boston, MA, November 2730, 1979. Ed. C.J.M. Northrup, Jr., SAND79-0955C. Plenum Press, New York, NY. 2, 771-778. Briesmeister, J.F., ed. (1986). MCNP: A General Monte Carlo Code for Neutron and Photon Transport. Version 3a. LA-7396-M-Rev. 2. Los Alamos, NM: Los Alamos National Laboratory. Brookins., D.G. (1978). Geochemical Constraints on Accumulation of Actinide Critical Masses from Stored Nuclear Waste in Natural Rock Repositories. ONWI-17. Office of Nuclear Waste Isolation (ONWI), Battelle Memorial Institute, Columbus, OH. Rechard, R.P., ed. (1993). Initial Performance Assessment of the Disposal of Spent Nuclear Fuel and High-Level Waste Stored at Idaho National Engineering Laboratory. SAND93-2330/1/2. 1-2. Sandia National Laboratories, Albuquerque, NM. Rechard, R.P. (1995). An Introduction to the Mechanics of Performance Assessment Using Examples of Calculations Done for the Waste Isolation Pilot Plant Between 1990 and 1992. SAND93-1378. Sandia National Laboratories, Albuquerque, NM. Rechard, R.P., ed. (1995). Performance Assessment of the Direct Disposal in Unsaturated Tuff of Spent Nuclear Fuel and High-Level Waste Owned by U.S. Department of Energy. SAND94-2563/1/2/3. Sandia National Laboratories, Albuquerque, NM. Rechard, R.P., Stockman, C.T., Sanchez, L.S., Rath, J.S., and Liscom-Powell, J. (1996). FEP Screening Argument; RNT-I: Nuclear Criticality in Near Field and Far Field. Screening Memorandum of Record (SMOR), SWCF-A: 1.2.07.3:PA:QA:TSK:RNT-1. Sandia National Laboratories, Albuquerque, NM. (Copy on file in Sandia WIPP Central Files, WPO 40818.) Rechard, R.P., Tierney, M.S., Sanchez, L.S., Martell, M-A. (1997). "Bounding Estimates for Critical Events when Directly Disposing Highly Enriched Spent Nuclear Fuel in Unsaturated Tuff," Risk Analysis 17:1, 32-49.
ACKNOWLEDGMENTS This work was supported by the United States Department of Energy under Contract DE-AC04-94AL85000. Sandia is a multi-program laboratory operated by Sandia Corporation, a Lockheed Martin company, for the United States Department of Energy.
B8" Industrial Safety
This Page Intentionally Left Blank
DERIVATION OF FATALITY CRITERIA FOR HUMANS EXPOSED TO T H E R M A L RADIATION P. J. Rew ~and I. P. McKay 2 l WS Atkins Safety & Reliability, Woodcote Grove, Ashley Road, Epsom, Surrey, KT 18 5BW, UK 2 Health & Safety Executive, St Anne' s House, University Road, Bootle, Merseyside, L20 3RA, UK
ABSTRACT A review of literature has been undertaken in order to assess the current status of the modelling of the effects of thermal radiation on humans. The applicability of models is considered through reference to medical data, which showed significant recent improvements in treatment of bums. The paper outlines the determination of fatality criteria based on the nature of the thermal radiation source (ultraviolet or infrared), the age distribution of the exposed population, their typical level of clothing and the effectiveness of medical treatment. The results of the review suggest that the 'Dangerous Dose' criterion of 1000 (kW/m2)4/3s is a reasonable estimate of the thermal dose at which serious bums may be received, or a small percentage of an average population may die. The LDs0 (Lethal Dose) equivalent was estimated to be in the range 1460 to 3500 (kW/mZ)a/3s. A value of no greater than 2000 (kW/m2)4/3s is suggested, noting the considerable uncertainty in the determination of such criteria and that there is justification for the use of lower values.
KEYWORDS
Fatality criteria, thermal radiation, safety assessment, lethal dose, dangerous dose.
INTRODUCTION The estimation of the effects of thermal radiation on humans is a key step in the assessment of risk for installations where flammable liquids or gases are stored. Various approaches are used in the assessment of the effects of thermal radiation on humans. Simple assessment of likelihood of fatality, or level of injury, can be made using thresholds of incident heat flux, I. More detailed analysis may be undertaken using probit models, based on the incident thermal dose, I4/3t, received. Early probit models were based on data from nuclear explosions (Eisenberg et al, 1975). However, these probit functions have been re-assessed (TNO, 1992) in the light of the difference in characteristics between the ultraviolet radiation from nuclear incidents and the infrared radiation from typical hydrocarbon fires. Also, there have been significant recent improvements in the medical treatment of bums, resulting in lower levels of mortality. A further consideration is the significant impact that escape from the fire site may have on the probability of fatality of 603
604
EJ. Rew and I.E McKay
the exposed population. Thus, most risk assessment methodologies must also consider the speed of escape, delay before escape begins and the distance travelled to reach shelter from the heat radiation. This paper outlines a methodology which is used to derive fatality criteria based on the nature of the thermal radiation source, the age distribution of the exposed population, their typical level of clothing and the effectiveness of medical treatment. Thus, technical justification is provided for proposed fatality criteria for an average population, in particular a 'Lethal Dose' (LDs0) equivalent, and uncertainties in deriving such criteria are discussed. Further discussion on the subject is given by Hockey & Rew (1996) and Rew (1997).
DEFINITION OF DOSAGE CRITERIA
Dangerous Dose A dangerous dose is one which gives rise to all of the following effects:
a) b) c) d)
severe distress to almost everyone; a substantial proportion of the exposed population requiring medical attention; some people seriously injured, requiring prolonged treatment; any highly susceptible people might be killed.
In other words, the dangerous dose is that which would give rise to a small (say 1% to 5%) probability of fatality for a typical population. Note that the dangerous dose is related to the thermal radiation criterion given by Kinsman (1991) where, for an average population, a dose of 1000 (kW/m2)4/3s is given as the level which may cause serious bums to many people and a small percentage may die as a consequence. The corresponding dosage for a vulnerable population, defined as one that includes people who may not respond effectively to evacuation procedures in an emergency, is 500 (kW/m2)a/3s. As discussed below, the approximate dosage for third degree (or full thickness) bums is 1000 (kW/m2)4/3s. Since full thickness bums are most significant in causing fatality (see Section 3.3), and this severity of bum requires intensiveand prolonged treatment (skin grafting etc.), then the Kinsman criterion for an average population seems reasonable. It should be noted that 1000 (kW/m2)4/3s is also the dosage given by the Eisenberg et al (1975) Vulnerability Model for 1% probability of fatality for a normally dressed average population. Although Eisenberg's model is known to include non-conservatism due to its use of nuclear incident data, it appears that, at least at low levels of fatality, this is offset by significant improvements in medical treatment since 1945, as discussed by Lawrence (1991).
Significant Likelihood of Death (SLOD)/LDso equivalent This is defined as the level of exposure to a specified hazardous substance or event, for which an exposed population would expect a significant probability of death. For toxic gas inhalation hazards, it is usual to assume the LDs0 to be representative of the SLOD dosage. The following definition of the toxic lethal dose (LDs0) is given by the IChemE (1985): 'the quantity of material administered orally or by skin absorption which results in the death of 50% of the group within a 14-day observation period,'
LDso EQUIVALENT BASED ON CURRENT METHODOLOGIES Various methodologies are available which can be used to predict the thermal dose which gives a 50% probability of fatality for a normally dressed average population. These LDs0 equivalent values are given in Table 1 below, with 1% probability of fatality calculated from each methodology for comparison. It can be
Advances in Safety and Reliability: ESREL '97
605
seen that there is a wide variation in predicted dose for both 1% and 50% probability of fatality. Without ignition of clothing, the maximum probability of fatality given by the TNO (1992) methodology is 14% for typical patterns of clothing cover. This results from the use of the Bull (1971) Mortality Chart for total bum area, while using a probit model for second degree burn area alone. However, TNO (1992) does state that ignition of clothing can be assumed to give a 100% probability of fatality, and that this occurs at between 2.5xl 04 and 4.5xl 04 (kW/m2)2s. The lower bound of this ignition criterion is equivalent to a dosage of 2700 (kW/mZ)4/3s for an exposure of 30 seconds, reducing to 1800 (kW/mZ)4/3s for an exposure of 10 seconds. TABLE 1 COMPARISON OF CURRENT METHODOLOGIES
Dosage (kWtm2)4/3s for probability of fatality of:
Methodology
Eisenberg et al (1975) Tsao & Perry (1979) TNO (1992) Lees (1994) 1]
1%
50%
960 420 520 1655
2380 1050 44401
based on ignition of clothing at 3600 (kW/m2)a/3s
BURN AREA FOR 50% PROBABILITY OF FATALITY The relationship between bum area and probability of fatality, for an average UK population group, is illustrated in Figure 1. The age distribution used for a UK population group is as given by the Central Statistical Office (1991), and is for the year 1991. Use of predicted population characteristics for 2001 makes a negligible difference to the analysis. Note that 'full thickness bums' are equivalent to third degree bums and cause complete destruction of the dermis. full t h i c k n e s s b u r n w i t h i n h a l a t i o n i n j u r y ......
full t h i c k n e s s
burn
-- -- -- total burn area 100
.........
c
a~ (/1
.S
,;
.,,...;..-
80
g ~
,~..~..
/ I
."
/
60
t~
,-& o c o
~
40 o'J
2 ~
2o " I " , ~. I f
t,n
~"""
0 0
~
20
~
i
40 60 burn area (%)
l
80
.................
100
Figure 1 Relationship between bum area and fatality for an average population The curve for total (second and third degree) bum area is based on the Mortality Chart produced by Lawrence (1991) and it can be seen that, in order to cause 50% fatality in an average population, a total bum
606
EJ. Rew and I.E McKay
area of 50% is required. Alternatively, based on the model of Clark & Fromm (1987), between 30% and 45% body surface area of full thickness burn is required. The lower level of full thickness burn area assumes that the victims also receive some form of inhalation injury. In reality, for industrial hydrocarbon fire incidents, inhalation injury is unlikely to affect many of the victims. However, in order to be conservative, it is assumed that 50% of an average population will die for a full thickness burn area of 30% total body surface area. It should be noted that, within the exposed population, there will be higher levels of fatality for certain vulnerable age groups. Thus, based on the calculations above, for the burn area resulting in 50% fatality in an average population, 96% of exposed people older than 84 will die, compared to 40% of those between the ages of 15 and 34.
EXPOSED SKIN AREA
Typical exposed body surface areas for a selection of population groups are summarised in Table 2, based on the Brandwonden (1979) method. For adults, with typical levels of clothing, the exposed body surface area is 20% and it is this value which is used by TNO (1992) in their Green Book methodology. For young children, or adults in shorts, the exposed skin area may be approximately 30-35%. Only in exceptional circumstances will average exposed areas be as high as 70% (say in beach resorts etc.). In this study, the typical exposed area is taken as 30%, which, as discussed above, can be assumed to give a 50% probability of fatality if fully covered by full thickness bums. It should be noted that, when calculating the burn area required to cause 50% fatality in a population, consideration was not given to the distribution of clothing levels that may be found in an average population group. For all age groups, an exposed area of 30% is considered to be pessimistic for most weather conditions in the UK. Taking into account the small fraction of an average population which may have exposed skin areas above 30% would have a negligible effect on predictions of fatality levels. Groups with higher mean exposed skin areas (those on beaches, playing fields etc.) cannot be considered to be a representative population and require special consideration. TABLE 2 TYPICALEXPOSEDBODYSURFACEAREAS Population group
iii~:
: :~:
Young children - typical clothing Adults - typical clothing Adults - sportswear Adults - hot summer day
......i : Body areas exposed
:
face, neck, lower arms, hands as above as above plus lower legs as above plus trunk and upper arms
Uncovered area (% total body surface) 30 20 35 70
THERMAL DOSE FOR FULL THICKNESS BURNS
Having defined the full thickness burn area required to cause 50% probability of fatality in an average population, it is necessary to define the thermal radiation dose which will produce this severity of burn. There is considerable uncertainty in defining this dose, both due to uncertainties in the experimental data (which tended to be conducted on porcine skin with various types of thermal radiation source) and because of the variation in susceptibility to bums of various body areas. Table 3 summarises experimental and incident data relating thermal dose to level of bum injury and it can be seen that there is little published data for third degree, or full thickness bums. The single set of data for third degree burns under infrared radiation is for burns from flame contact on porcine skin and falls within the second degree burn range. Therefore it is not considered to be suitable for use as the threshold dose for third degree bums. Tsao & Perry (1979) suggest that an ultraviolet dose can be related to an infrared dose by dividing it by 2.23, which appears to be confirmed by the data given below. Thus, it may be possible to use
Advances in Safety and Reliability: ESREL '97
607
the two ultraviolet datasets for third degree burns, giving 550-800 (kW/m2)4/3s and 1400 (kW/m2)4/3s, for Glasstone & Dolan (1977) and Hinshaw (1957) respectively. The Glasstone & Dolan (1977) data is not consistent with the majority of the second degree burn data. It is also based on nuclear incident data and is therefore likely to be prone to large uncertainties (exposure duration, effect of shelter and distance of victims from source). Therefore it also is not considered to be suitable for use as the threshold dose. This leaves the Hinshaw (1957) data, obtained using a carbon arc lamp (assumed to produce radiation close to the ultraviolet end of the visible spectrum) radiating onto porcine skin. The values given in Table 3 for the Hinshaw data are those given by Hymes et al (1996) and are based on a correlation relating thermal dose to depth of damaged skin. Analysis of the Hinshaw data gives a standard deviation of 12.5 % with respect to the Hymes correlation for the predicted thermal dose, suggesting a range for the third degree, or full thickness, burn value (based on two standard deviations) of 1000 to 1750 (kW/m2)n/3s. The lower end of this range is used in this analysis, although, due to the uncertainty in the determination of this value, and in the interpretation of the data on which it is based, consideration is also given to the use of the upper limit for second degree bum data (730 (kW/m2)a/3s) as the threshold dose for full thickness bums. TABLE 3 COMPARISON OF ULTRAVIOLETAND INFRAREDBURN DATA
Dose (kW/m2)4/3s
Bum Severity
Infrared
Ultraviolet First degree
Second degree
Third degree
290 260-440 300-440 670-960 810-950 c. 1000 1100
Tsao & Perry (1979) d* Eisenberg et al (1975)* Glasstone & Dolan (1977)* Glasstone & Dolan (1977)* Eisenberg et al (1975)* Mixter (1954)P~ Hinshaw (1957)P~
1220-1790 3100
Glasstone & Dolan (1977)* Hinshaw (1957)P~
= carbon arc lamp f = burns from flame contact
* = nuclear incident data p = porcine skin
c.80 130
Mehta et al (1973)Pf Tsao & Perry (1979) a
240 270-410 c.350 290-540 730 c.500
Stoll & Green (1958) Stoll & Green (1958) r Mehta et al ( 1973)Pf Williams e t a l (1973) f Arnold et al (1973) f Mehta et al (1973)Pf
d = derived from a range of experiments r = white rat skin
As discussed by Lees (1994), the effective thermal radiation dose received by a victim will depend on body geometry. When defining a dose criterion for exposure to thermal radiation, it is usual to give a value for the maximum cumulative dosage incident at the victim's location. In practice, this dosage will be distributed over the body surface, the particular distribution depending on the mode of escape and body geometry. In the simplest case, it could be assumed that the dose is spread evenly between the front and back of the body, and that the exposed body areas could be treated as plane surfaces. Thus the effective dose received over the exposed skin is half of the cumulative thermal dose incident at the victim's location. In reality, the geometry of the body is not planar. If parts of the body are treated as circular cylinders then the mean dose received over the exposed skin areas would be a factor of E lower than the cumulative incident dose, assuming even distribution of radiation over the exposed areas. Similarly, for spherical body parts, the reduction factor will be 4. In practice, the exposed areas of the body will be a combination of planar, cylindrical and spherical geometry. Also, the victim's body will not necessarily be perpendicular to the direction of incidence of the thermal radiation, and so the effective dose received per skin area will be further reduced for the planar and cylindrical parts of the body. For the purpose of defining an LDs0 equivalent, it is conservatively assumed that the mean dose received on the exposed skin area of a victim is half that of the cumulative incident dose. Therefore, the cumulative incident dose required to produce 50% probability of fatality, i.e. the LDs0 equivalent, is double that required to give full thickness burns. Based on the range for full thickness burns
608
RJ. Rew and I.R McKay
discussed above, the required cumulative incident dose can be assumed to be between 1460 and 3500 (kW/m2)n/3s. IGNITION OF C L O T H I N G A further consideration in the prediction of fatality due to thermal radiation incidents is ignition of clothing. In general, it is assumed that the ignition of clothing will result in certain fatality, which may be pessimistic. Certainly, fatality levels for hydrocarbon fire incidents are likely to be of the order of 50% or above and, therefore, the ignition of clothing may have an effect on the LDs0 equivalent for certain scenarios. There are also significant uncertainties relating to the predictions of the intensity and duration of thermal radiation required to cause ignition of clothing. Criteria for ignition of clothing are compared in Figure 2, where the TNO (1992) criterion is shown to be more conservative than the Hymes et al (1996) model. The lower bound of the TNO criterion of 2.5x104 (kW/m2)2s only becomes significant to the definition of the LDs0 equivalent for an exposure duration of less than 13 seconds. Note that, for a duration of 10 seconds, the equivalent thermal dose for ignition corresponding to the lower bound of the TNO (1992) criteria is approximately 1800 (kW/m2)4/3s. It is assumed that, once an item of clothing ignites, flame spread will result in burns over a large proportion of the body surface. Thus a dose of 1800 (kW/m2)a/3s needs only to be incident at one point on the body in order to result in extensive burn injury and a high probability of fatality. 1000
i
A
E
• A • • O [] •
.......
10o
1
10
type 1: PE/cotton piloted type 1: unpiloted type 4: denim piloted type 10: cotton piloted type 11: acetate/nylon melts type 19: fire retardant piloted type 20: wool piloted .TNO (1992) Lees (1994)
100
exposure duration (s)
Figure 2 Comparison of Hymes et al model with TNO and Lees criteria
DERIVATION OF LDso EQUIVALENT Based on the above arguments, for an average UK population, an LDs0 equivalent in the range 1460 to 3500 (kW/m2)n/3s could be postulated; a value of 2000 (kW/m2)a/3s is proposed in this paper as it is considered that use of 730 (kW/mZ)4/3s for full thickness is pessimistic and 1000 (kW/m2)n/3s seems a more reasonable estimate of the lower bound for this degree of burn. In deriving this value, three key conservative assumptions have been made, as follows: 1. Inhalation injury is assumed to occur for all members of the exposed population, giving a full thickness burn area of 30% (rather than 45% without inhalation injury) for 50% probability of fatality. 2. The typical level of exposed body area is 30%, compared to 20% used by TNO (1992). 3. The exposed skin areas can be assumed to be planar, with radiation distributed evenly between them.
Advances in Safety and Reliability" ESREL '97
609
This conservatism is countered by the following uncertainties: 1. No consideration has been given to the effect of thermal doses of greater than 1000 (kW/m2)"/3s being incident on the exposed skin areas. This will occur if the radiation dose is not evenly distributed between the back and front of the victim. The medical data reviewed in this study does not specifically consider the effect on fatality of body tissue being damaged significantly beyond the dermis (a full thickness burn is defined as one that damages the full dermis layer). However, it is assumed that the records upon which the models or mortality charts were based included victims with such injuries. As noted by Hockey & Rew (1995), serious burns can damage muscle tissue and bones and have the potential to cause fatality even for small burn areas. 2. There is considerable uncertainty in the use of 1000 (kW/m2)n/3s as the dose which produces full thickness burns on human skin. As discussed above, the experimental work of Hinshaw (1957) suggests that the thermal dose for full thickness burns lies in the range of 1000 to 1750 (kW/mZ)a/3s. The effect of the use of the above assumptions in the production of the proposed LDs0 equivalent, and the uncertainties relating to the prediction of thermal dose required to cause full thickness bums, are illustrated in Figure 3. This figure also shows the range of criteria used as the threshold level for ignition of clothing, marked as the shaded area. It can be seen from the figure that the proposed LDs0 equivalent is similar to the lower bound for ignition of clothing. The lower bound is that given by TNO (1992), which for an exposure duration of 10 seconds is equivalent to a dose of 1800 (kW/m2)4/3s. This is the value which would need to be adopted to encompass the range of uncertainties in the modelling of ignition of clothing. The model of Hymes et al (1996) suggests that, for an exposure duration of between 10 and 30 seconds, some clothing types will not ignite until exposed to a thermal dose of greater than 6000 (kW/m2)4/3s. Ignition of clothing can be considered to produce 50% probability of fatality (or higher). Thus removing any of the conservatism discussed above would not significantly change the value of the proposed LDs0 equivalent. In fact, for short exposure durations, use of the TNO (1992) ignition criteria would suggest use of a lower LDs0 equivalent. 2nd degree i
full thickness burn
3rd degree max.
.... ~rd: degree min:i
body shape unclothed area
....
planarl 70%
inhalation injury
spherical
.... ~0% . . . . . . . ~es
20%
>
l
no
overall uncertainty
I
l
SHADED = RANGE OF THRESHOLD LEVELS FOR CLOTHING IGNITION I 1000
I 2000
I 3000
I 4000
thermal dose (kWlmZ)4~3s
Figure 3 Uncertainty in the definition of the LDs0 equivalent CONCLUSIONS The value for the LDs0 equivalent is in the range 1460 to 3500 (kW/m2)4/3s, based on the cumulative maximum incident thermal radiation at the location of the exposed population. A value of 2000 (kW/mZ)4/3s is proposed. If the lower bound of the TNO (1992) criteria for ignition of clothing is used, then the LDs0 equivalent should be reduced to 1800 (kW/m2)4/3s. It should also be noted that the modelling of fatality within a hazard assessment will be highly dependent on the particular scenario modelled. For example, the
610
EJ. Rew and I.E McKay
proposed LDs0 equivalent is not suitable for events in which fire engulfment of personnel occurs, where different heat transfer mechanisms exist (not radiation alone), exposure is shorter but more intense, and exposed body surface areas are greater. There is a large amount of uncertainty in the determination of the proposed LDs0 equivalent, as discussed above. However, it seems reasonable to use the proposed thermal dose as that for which there is a significant probability of death and, therefore, as a 'significant likelihood of death' (SLOD) criterion. The exact probability of fatality will vary depending on the age and response of the population to the incident and their level of clothing. The information presented in this report on the severity of bum injury, typical levels of clothing and medical data (relating area of bum injury to fatality) can be used as a guide to predict the probability of fatality for non-typical cases, for example school playing fields or holiday resorts. In those cases, the proposed LDs0 equivalent can only be used as an estimate, of the number of fatalities expected.
ACKNOWLEDGEMENT
The work described in this paper has been undertaken on behalf of the UK Health & Safety Executive. However, the views expressed in this paper are those of the authors and are not, except where the context indicates, necessarily those of the HSE.
REFERENCES
Arnold et al, (1973). Hazards from burning garments, Gillette Research Institute, NTIS: COM-73-10957. Brandwonden, (1979). Philips-Duphar Nederland B.V., Amsterdam. Bull, J. P. (1971). Revised Analysis of Mortality due to Bums, The Lancet, 1133-34. Central Statistical Office, (1991). Annual Abstract of Statistics, HMSO. Clark, W. & Fromm, B. S. (1987). Bum Mortality - Experience at a Regional Bum Unit, Acta Chirugica
Scandinavica Supplementum 537, Stockholm. Eisenberg, N. A. et al. (1975). Vulnerability Model: A Simulation System for Assessing Damage Resulting From Marine Spills (VM1), ADA-015-245 US Coast Guard NTIS Report No. Cg-D-137-75. Glasstone, S. & Dolan, P. J. (1977).
The Effects of Nuclear Weapons, 3rd Edition.
Hinshaw, J. R. (1957). Histologic studies of some Reactions of Skin to Radiant Thermal Energy, ASME Paper 57-SA-71. Hockey, S. M. & Rew, P. J. (1996). Review of Human Response to Thermal Radiation, HSE Contractor Report WSA/RSU8000/026, HSE Books. Hymes, I., Boydell, W. & Prescott, B. (1996). Thermal Radiation: Physiological and Pathological Effects, Major hazards monograph, I Chem E. IChemE, (1985). Nomenclature for Hazard and Risk Assessment in the Process Industries. Kinsman, P. (1991). Major Hazard Assessment: Survey of Current Methodologies and Information Sources, HSE Specialist Inspector Reports No. 29. Lawrence, J. C. (1991). The Mortality of Bums, Fire Safety Journal 17. Lees, F. P. (1994). The Assessment of Major Hazards: A Model for Fatal Injury from Bums, Trans. IChemE
Part B 72, August. Mehta, A. K., Wong, F. & Williams, G. C. (1973). Measurement of Flammability and Burn Potential of Fabrics, Summary report to NSF-Grant #GI-31881, MIT.
Advances in Safety and Reliability: ESREL '97
611
Mixter, G. (1954). The Empirical Relation Between Time and Intensity of Applied Thermal Energy in Production of 2+ Burns in Pigs, University of Rochester Report No. UR-316, Contract W-7041-eng-49. Rew, P. J. (1997). LDso Equivalent for the Effect of Thermal Radiation on Humans, RSU3520/R72.027, HSE Books, UK. Stoll. A. M. & Green, L. C. (1958). The Production of Burns by Thermal Radiation of Medium Intensity, ASME 58-A-219. TNO (1992) A Model for the Determination of Possible Damage, CPR 16E. Tsao, C. K. & Perry, W. W. (1979). Modifications to the Vulnerability Model: A Simulation System for Assessing Damage Resulting From Marine Spills (VM4), ADA 075 231, US Coast Guard NTIS Report No. CG-D-38-79.
This Page Intentionally Left Blank
AN INHERENT SAFETY OPPORTUNITY AUDIT/ TECHNOLOGY OPTIONS ANALYSIS Nicholas A. Ashford ~and Gerard Zwetsloot 2 1
Massachusetts Institute of Technology, Cambridge, Mass., USA and Ergonomia, Ltd., Athens, Greece 2 Dutch Institute for the Working Environment NIA-TNO, Amsterdam, the Netherlands
ABSTRACT A methodology is presented for encouraging firms to undertake primary accident prevention through an inherent safety opportunity audit or technology options analysis. Experience gained from its application in firms in the Netherlands and Greece will be discussed.
KEYWORDS accident prevention, inherent safety, occupational safety, prevention, safety, safety audit, technology options, technology assessment
INTRODUCTION
It is now generally recognized that in order to make significant advances in accident prevention, the focus of industrial firms must shift from assessing the risks of existing production and manufacturing systems to discovering technological alternatives, i.e. from the identification of problems to the identification of solutions (Ashford et aL 1993). The underlying premise of this project is that encouraging the industrial firm to perform technology options analysis (TOA) and to consider technological changes through an inherent safety opportunity audit will advance the adoption of primary prevention strategies that will alter production systems so that there are less inherent risks. In many cases, alternative production processes exist which completely, or almost completely, eliminate the use of highly toxic, volatile, or flammable chemicals. Normal accidents arising in these systems result in significantly less harmful chemical reactions or releases. Replacement of existing production systems by such benign chemical processes--sometimes called "green chemistry", as well as non-chemical approaches, are examples of primary accident prevention. Primary accident prevention approaches are similar to cleaner production/pollution prevention in that fundamental changes to the production system are contemplated, In contrast, secondary accident prevention parallels end-of-pipe pollution control with minimum changes to the fundamental production system. Industry often approaches cleaner production/pollution prevention and accident prevention quite separately, missing the opportunity to make production changes which address both problems simultaneously (Zwetsloot 1994). Acquiring knowledge about primary prevention/inherently safer technologies is essential for industry. The presentation of this paper will report progress on a project investigating the feasibility of developing an inherent 613
614
N.A. Ashford and G. Zwetsloot
safety opportunity audit/technology options analysis to encourage the adoption of primary prevention approaches by firms in the Netherlands and in Greece. These approaches involve both technological and managerial changes. Firms must have the willingness, opportunity, and the capability to change. An inherent safety opportunity audit provides firms with information that enhances their capability, and having then been alerted to new possibilities, this affects their willingness to change.
A METHODOLOGY FOR UNDERTAKING AUDIT/TECHNOLOGY OPTIONS ANALYSIS
AN INHERENT
SAFETY
OPPORTUNITY
We describe below the methodology employed in working with individual firms by NIA-TNO and Ergonomia, Ltd. in the Netherlands and Greece.
Phase One
1. Start-up and Obtaining Commitment from the Firm
Obtain general commitment and cooperation from management Select possible (parts of the) plant/unit/process/division Obtain the specific commitment of the management of that (part of the) plant/unit/process/division Formulate and formalize project goals and project plan
2. Initial Design and Preparation
Form a 5-7 member project team within the selected plant/division: firm members should be representatives of Safety (possibly including members of the health and safety committee), Technology (e.g., a design/chief engineer), Operations, Maintenance, Quality Control, and Management; one or two representatives from NIATNO/Ergonomia should also participate. Choose the project team manager (a major firm pioneer with some authority). The project team should construct the project plan. Project team to obtain commitment from all members, gather background information, and organize an informational meeting within the plant/division. Project team to work in all of the subsequent aspects of the project
3. Conduct a traditional Safety Audit
This safety audit is used for identifying inputs and material flows, processes and intermediates, and final products--but with special attention paid to human-material/process/equipment interactions that could result in (a) sudden and accidental releases~spills, (b) mechanical failure-based injuries, and (c) physical injuries--cuts, abrasions, etc. as well as ergonomic hazards. Additional sources of adverse effects/safety problem areas are records/knowledge of in-plant accidents/near misses, equipment failures, customer complaints, inadequate secondary prevention/safety procedures and equipment (including components that can be rendered non-operable upon unanticipated events), inadequacies in suppliers of material and equipment or maintenance services (see 4 below).
Advances in Safety and Reliability: ESREL '97
615
4. Selection of candidate processes or operations within the firm
Select candidate processes or operations within the firm that warrant special attention. The criteria for identifying these include three categories: (a) general safety information, (b) symptoms of inherent unsafety, and (c) inefficiency of safety management as detailed below:
general safety information the results of the risk assessment conducted in the firm findings stemming from statistical process control databases for reliability of components, materials, etc. records from test activities (e.g. devices, components or from software) evaluations from accident-preparedness tests environmental permits liability assessments occupational or environmental safety reports (for Post-Seveso Guideline) life cycle assessments environmental impact assessment documents results from HAZOPS, Fault-tree Analyses, etc. findings from safety or environmental audits
symptoms of inherent unsafety incidents, near,misses, and spills (reported or not) including analyses thereof resulting in the identification of direct and root causes accidents (recorded or not), including analyses thereof resulting in the identification of direct and root causes records from trouble-shooting activities added-on technical safety measures (back-up systems, collective and personal protective measures, etc.) presence of obviously-hazardous situations (including hazardous materials) economic data about failure costs from risk-management activities complaints about product safety from customers records of non-conformance of product quality
inefficiency of safety management number and nature of procedures or prescriptions to control hazards (e.g., in safety directives or handbooks) number and nature of necessary work permits schedules for preventive maintenance
5. Functional review
Review of the functional purposes of materials, equipment, processes and operations--noting obvious inefficiencies in material/water/energy use and gradual pollution, and obvious hazards due to spatial combinations of functions.
6. Specific set of search questions
Construction of a specific set of search questions to guide identification of opportunities for material substituti-
616
N.A. Ashford and G. Zwetsloot
on, equipment modification/substitution, changes in work practices and organization, modifications in plant layout, and changes in final product. Making use of the following table of preventive principles relevant to inherent safety.
TABLE 1 PREVENTIVEPRINCIPLESAPPLYINGTO MATERIALS/SUBSTANCES,PROCESSESAND PRODUCTS RELEVANTTO INHERENTSAFETY(DERIVEDFROMZWETSLOOT 1994) preventive principles
materials & substances
processes
products
preclude or eliminate inherent safety risks
low human toxicity
low energy intensity
ergonomic design
low eco toxicity
simple, integrated design (minimal added on measures)
no or low flammability no skin penetrating properties
ergonomic design
low volatility no or low dust forming properties preclude or eliminate sources of safety hazards
containment
ease of maintenance and disassembly
low pollution intensity foolproof for essential functions adequate information for customers & workers
identifiability of components separability of components
controllability (broad tolerance of maloperation or poor maintenance)
7. Brainstorming to generate options Plan creative brainstorming sessions to generate as many initial options as possible. suggestions from:
Solicit and cull
firm operatives, maintenance persons, supervisors, engineers, safety experts, workers, unions; include suggestions that had previously been made by these "local experts" and "rumours" or topics not usually addressed openly minutes of safety meetings, from cross-functional meetings, e.g., company-contractor, operations-maintenance, etc.
Advances in Safety and Reliability: ESREL '97 •
617
data about technical/process alternatives that have been evaluated but not implemented evaluations of ad hoc solutions, especially arising in the context of trouble-shooting activities
8. Construction of search process for information on options/alternatives.
Planning the process of using external sources;potentially useful are solution databases (such as compiled by Lyngby, DK. the Danish EPA and NIA-TNO), safety performance/benchmarking data, literature on process safety and reliability, literature on cleaner production/pollution prevention, academic experts/researchers-including the NIA-TNO/Ergonomia project staff, in-plant expertise including plant workers/union, suppliers, equipment manufactures, other domestic firms, foreign firms and technology, and national/international unions.
9. Identification of promising options
Identification of promising altematives/options for materials, equipment, processes, operations, work practices and organization.
10. Design of consistent set of system changes
With the involvement of both production and safety/environmental people, design intemally-consistent sets of 2-3 alternative overall system changes encompassing multiple component changes related to 9 above.
11. Feasibility study
Conduct feasibility studies utilizing rough relative economic (cost) and safety assessment for these 2-3 system changes. Also included are environmental impacts and organizational impacts and requirements.
12. Commitment of the project team
Present results of the feasibility studies to the project team.
13. Recommendations to management
Recommend system changes to the firm.
Phase Two
14.
Supporting decision making
Mobilize the decision-making processes within the plant/unit to implement the selected system, recognizing overall firm imperatives and constraints.
15.
Preparation of implementation
Work with in-plant personnel (both production and safety/environmental people, and the safety and health committee) to design general approach to changes in plant.
618
N.A. Ashford and G. Zwetsloot
Phase Three 16. Monitoring of actual design changes.
In-plant project team to monitor and evaluate the progress and success of the implemented options/system on the bases of safety, quality, technology, costs, and environmental impact.
Phase Four 17. Evaluation of overall project
Project team to evaluate the outcome of inherent safety project in the firm and formulate additional recommendations. This includes the results of plant management evaluation.
COMMENT The experience and results obtained in implementing the inherent safety opportunity audit/technology options analysis in the participating firms will be presented at the conference.
REFERENCES Ashford, N., Gobbell, J., Lachman, J., Matthiesen, M., Minzner, A., and Stone, R. (1993) The Encouragement
of Technological Change for Preventing Chemical Accidents: Moving Firms from Secondary Prevention and Mitigation to Primary Prevention, Center for Technology, Policy and Industrial Development, Massachusetts Institute of Technology, Cambridge, Massachusetts. Zwetsloot, G. (1994) Joint Management of Working Conditions, Environment and Quality: In Search of Synergy and Organizational Learning, Dutch Institute for the Working Environment (NIA-TNO), AMsterdam, The Netherlands.
LIVE W O R K SAFETY AUDITS Nuno Mendes Serviqo Prevenq~o e Seguranqa Interempresas EDP- Electricidade de Portugal, S.A., 1070 Lisboa, Portugal
ABSTRACT Electrical networks are subject to scheduled shut-downs. Aiming to reduce them, intervention techniques on live overhead lines (better known as live work) have been created. They allow thus the maintenance and modification of installations, without interrupting the electric power supply. After an introductory approach on the most relevant points of live work techniques, the author alleges that the accomplishment of safety audits is a management method that permits: the prompt detection of non-conformities; to check if standards and procedures are correctly applied; and to assess contractors activities, with reflection in their qualification. The different elements related with the implementation of audits are presented: the composition of the auditing team. the planning, the elaboration of checklists, the accomplishment, as well as the most important points to be checked at crew's quarters and at the worksite.
KEYWORDS
Electrical networks maintenance, live work, safety audits.
1. I N T R O D U C T I O N With the liberalisation of the market and the pursuit of earnings in competitiveness, the electrical power companies opted to concentrate their efforts to fulfil the needs of their clients, who have become more demanding and conscious of their fights, resorting, in a increasing rate, to service providers for their construction and maintenance works. The increase in demand corresponded to an increase of the number of contractors found on the market, and the conditions for competition among them has led to a larger rotativity of specialised workers. On the other hand, the flexibility of the labour laws makes it relatively easy to hire new workers, who often do not have the necessary preparation (training and experience), nor suitable safety culture in regards to the tasks they are called upon to perform. Such circumstances contribute to the raising of the safety difficulties, befalling upon the contracting companies to define the procedures which will allow one to minimise the situations of risk and to check that the job is executed in a safe way and with the intended quality. 619
620
N. Mendes
2. THE LIVE W O R K T E C H N I Q U E S M O S T R E L E V A N T ASPECTS
2.1. Live Work
Live Work (LW) - A generic term indicating the various working methods used to work on or near electrical installations whilst energized. In particular all work on which a worker can enter into the defined live working zone with either parts of his body or with tools, equipment or devices being handled. In a technologically more advanced and electricity dependant world, any flaw in its supply may cause damages or, at least, troubles to its consumers: from the blocking of an elevator, to the halting of work in a facto1T. passing through the loss of files in a computer application, everyone has been involved in at least one of these situations. The electrical networks (aerial or underground) are permanently exposed to the most varied types of aggressions, natural (atmospheric discharges), or human (falling trees, excavations), which cause unexpected. and at time inevitable interruptions, despite the efforts undertaken for the introduction of better network equipments and in the awareness of the people who work in the vicinity. The same networks (especially the distribution ones) are also subjected to programmed shut-downs, resulting from the connection of new consumers, topological alterations due to the construction of buildings or roads, as well as the preventive maintenance actions as they are made up by a myriad of elements (conductors, poles, cross arms. terminals. transformers, protections .... ) with very diversified reliabilities. The LW techniques allow for the execution of maintenance and modification works on installations, without any interruption of the power supply. One presents, as follows, some examples of works who can be performed live: • At low voltage (LV): Poles, conductor and distribution boxes replacement; connection/disconnection of consumers; • At medium voltage (MV): Mounting of line disconnectors; replacement of pin insulators by string insulators; connection/disconnection of feeders; • At high (HV) and very high voltage (VHV): Application of anti-vibrators; repairing of conductors: replacement of any type of terminal on lines and primary substations. Despke the already achieved progress, one can still follow the development of the LW throughout the world. through new kinds of jobs such as the washing of insulators with pressurised water jets (or more recently, vdth special abrasives) or through the new means of operator supports: • On VHV aerial lines the operators intervene from a '~oucket", suspended from a helicopter; • There are about a hundred robots in Japan which are capable o£ amongst other things, inserting a line disconnector into a 30 kV line. Each one of these robots are made up of an insulating ground booth housing an operator who manoeuvres two, also insulating, arms which act as the operator's hands: tlfis assembly is mounted on an articulated arm whose base is supported on the chassis of a vehicle.
2. 2. The Safety on the L W
In executing live work, the lineman is perfectly aware of the elevated degree of hazard of the physical agent he is "manipulating" - electricity, but he is also sure that he is provided with perfectly suitable means and teclufiques which allow him to work with low levels of risk. LW thus constitute a significant field of application of the Integrated Safety principles once: • Only the workers expressly trained in the LW techniques are allowed to work live. The personnel authorised to perform these works were selected (special relevance is given to medical examinations) and trained in the most suitable LW methodology, in accordance to a specific work programme, one obtaining thus a high intervention reliability; • The qualification diplomas given to elements who did well in the respective courses are valid for a year. thus having to be renewed. A LW worker who has been 6 months without work must return to training:
Advances in Safety and Reliability: ESREL '97
621
• The tools and equipment were projected, manufactured and tested for the effect (both in an isolation point of view as for their mechanical function), being subjected to periodical controls; • The professed methods and the organisation of the works were profoundly and criteriously studied; • All factors capable of providing the LW intervenients with a better performance were considered through the analysis of the several working posts; • The work organisation is extremely rigorous as it compiles to a well defined set of parameters with each of the main "actors" (Exploitation Manager, Crew Chief and Executors) playing their role in perfection.
2.3. The L Win the EDP LW are. since 1981 in LV and since 1982 in MV, a reality within the EDP Group's Distribution Companies; as of 1988 these have also been executed by companies which provide services to EDP.
2. 4. Legal and regulatory support The LW practice in electrical installations is authorised in the Portuguese Legislation, in the Safety Regulations regarding the electrical sector (HV electrical lines, Primary substations and MV/LV and dividing substations, LV electrical power distribution networks, Electrical power utilisation installations). These texts only cover the general principles, with the specific regulations, elaborated by the EDP, being made up by the following documents: • General Prescriptions which, complying with that which is found in the Safety Regulations, establish the set of safety conditions to be observed by specialised crews in the execution of the LW in Electrical Power Distribution Installations; • Work Execution Conditions, which define the general rules to comply with in the performance of a LW. These conditions establish the work preparation, the tools' utilisation and the correct verification of the work modalities. They also include rules regarding the atmospheric conditions and the Special Exploitation Regimen (see 2.6); • Operational Processes, which establish a minimal set of sequential operations to comply with in the execution of certain works; • Technical Cards and Operational Methods, regarding each equipment or tool, with the description of their characteristics and utilisation conditions; they also describe the conservation, maintenance. transportation and tool control conditions.
2. 5. Working methods One discerns three working methods, according to the executor's situation in regards to the live parts and according to the means he uses to protect himself from electrization and short circuit risks: • Rubber Glove Working - the executor works in contact, protecting himself (by means of dielectric gloves) from the live bare parts, which in turn must also be covered with insulating materials (blankets. covers and screens). In the EDP, this is the method used at LV; • Hot Stick Working - the executor maintains a permanent distance which is equal or above a Minimuml Approach Distance between his hands (as well as that of all parts of his body) and the bare live part on which he intervenes. He works with the help of tools mounted at the end of insulating poles. This is the method utilised, in the EDP, at MV networks; • Bare Hand Working - the executor works with his "bare hands" (that is, without any dielectric gloves but with mechanical protection gloves) at the potential of the part he is working on. He finds himself in the identical situation as that of a bird on an electrical line. Consequently, the executor's whole Evolution Zone is at the referred potential rate, one having to maintain a Minimum Approach Distance between tiffs zone and all other parts at the service voltage. This is the method chosen for interventions on HV and VHV aerial networks.
622
N. Mendes
2. 6. Special exploitation regimen The execution of a LW on a MV network implies the existence of a special safety procedure which consists of placing the installation on which one is intervening on, on a Special Exploitation Regimen (SER). One considers a MV installation as being in SER when any automatic reclosing is rendered impossible; the temporisation of the installation's selective protections has been eliminated; all appropriate dispositions were taken in regard to the device for the detection of resistant earths; no restitution of tension after tripping may be made without the acknowledgement of the Crew Chief. The SER does not protect the executor from the possibility of the occurrence of an electrical accident, but it avoids that the consequences of the same are aggravated, apart from averting eventual electrizations of other executors who come in aid of the hurt one.
3. LW P E R F O R M E D BY SERVICE P R O V I D E R S
There are presently within the EDP Group, around fif~ service providers within the dominions of LV, MV and HV. The emergence of a market for service providers with the capacity to work live, forced the EDP to create quality mechanisms with the objective of guaranteeing desirable safety levels for personnel and installations. Ii is important that the high safety standards reached world-wide today, and specially in the EDP, continue to be guaranteed, by means of a rigorous control of the quality of the provided service, where safety integrates as a determining factor.
3.1. The qualification and selection of the service provider as a prevention factor Wkh the implementation of a qualification process regarding the service provider, one intends to privilege the technical part and simultaneously the safety part and the working conditions, foreseeing eventual risks which result from the utilisation of less qualified service providers This recognition will come to create the conditions for the establishment and development of partnership relations between the contracting company and the service providers, namely in where it concerns safety, and quality assurance, with the following immediate advantages: • it facilitates the definition of common objectives in regards to safety; • it establishes permanent communication channels between the Company's safety services and that of the service provider's; • it facilitates the elaboration and application of safety plans; • it facilitates the execution ofjoint initiatives within the dominion of information and worker training
3.2. How safety integrates the qualification and selection process of the service providers The utilisation of service providers is based on the principle of one opting for the one(s) who are more apt for the execution of a certain job, considering not only the specifics of the same, but also the inherent risks to the same. The selection of the more apt ones must be made by means of a process which bears in mind the service providers' performances, according to a set of parameters which include, amongst others: their technical capacity; their economical and financial capacity; the safety, hygiene and health conditions at work; the quality assurance (quality of the executed works, compliance with deadlines, commercial relations). In regards to the parameter "safety, hygiene and health conditions at work", the classifications are given with the participation of the safety services.
Advances in Safety and Reliability: ESREL '97
623
The evaluation of the service providers is made according to a scale of values which normally varies between 1 and 4 with the following relation value/concept: Level I - Very good; II - Good; III - Average; IV - Poor. The service provider classified at level IV may not be registered in the list for qualified service providers and will consequently be hindered from executing any jobs for the Company; the one classified at levels I, II or III is recognised as being qualified and will be registered in the list of service providers available for consultation: the service provider classified at level Iii is understood as being associated with precautionary recommendations. being therefore subject to a tighter control.
3.3. How the "safety "parameter is evaluated The evaluation of the safety parameter is based on the analysis of four factors: • Compliance to safety rules and dispositions • Efficiency in the correction of registered anomalies • Frequency rate • Severity rate The two first are related to the fulfilment, by the service provider, of the applicable rules and regulations related to safety, the job's safety plan (should there be one) and the Contractual Dispositions on Safety, Hygiene and Health included in the specifications. The safety audits constitute an objective means to evaluate the degree of satisfaction in regards to the referred to set of evaluation facts, either through the obtained results and found defects, or through the service providers actuation in the repair of the anomaly and their collaboration with the Company in the solving of safety problems. The last two factors demonstrate the obtained results in regards to the accidents during the executed works for the Company and their evolution. The analysis of the accident rates though not being in themselves conclusive. complement and confirm the evaluation made through the safety audits, whose results allow one to evaluate in a more rigorous way the safety culture of the service provider. The ponderation of the frequency and severity rates is normally effectuated based on a scale of values, the definition of which one considers the values obtained by the various service providers, the indicators at a national level and the company's experience. Such scales must not be applied indifferently to any type of activity without a previous analysis of their suitability, bearing in mind namely, the size of the service provider. More important than the comparison of rates between different companies is the observation of the respective evolution of each one. On the other hand, the value scales must be periodically reviewed in order to show the positive evolution of the working conditions and the existence of natural expectations regarding the improvement of the accident indicators. The requirements imposed in the qualification process for "LW Service Provider" foresee an audking by the representatives of the Direcq~o-Central de Tecnologia e Aprovisionamento (DTA) and by a representative of the Distribution Company in the area where the service provider is established. Despite the origins of the training beingthe most diversified, all service providing companies are subjected to the regulation in force in the EDP Group of Companies.
4. LW SAFETY AUDITS The performance of an audit presupposes the joining of several factors: independent auditors in relation to the audited crew; the existence of a norm, internal regulation or operational procedure; checklists prepared beforehand; agreement by and the participation of the audited party; registration of the observations made during the audit.
624
N. Mendes
4.1. The auditing crew requirements The audking crew must: • be made up by three elements without any hierarchical nor functional bond to the audited party: a functional leader of the Technical Area (co-ordinator), advised by two LW and safety and prevention specialists; • be informed in detail about the organisational and technical aspects of the crews to be audited; • act with discretion, in an objective and reasonable manner, analysing, interviewing, evaluating and recommending, without interfering, opposing or hindering the normal operation of the audited party.
4. 2. Auditing planning During the planning one will perform the sedation of the set of actions to develop for the consubstantiation of the audit, namely: the gathering of base documentation; the scope of the work to be audited; the duration of the audit; the parameters to integrate the checklists.
4.3. Checklists The checklists must refer: • the identification of the auditors, reference number and date; • the identification of the operational unit and the audited crew; • the localisation of the installation where the work is performed; • applicable regulation; • the registration of the observations made, the contacted elements and the conclusions reached. The lists may include alternative answer questions (yes/no) or with the possibility of explanation, leading eventually to other questions, ensuring in this way the obtaining of the largest amount of information possible in order to reach the auditing objectives.
4. 4. The performance of the audit A foregoing meeting, in which the auditing crew and the hierarchy of the crew to be audited participates, will initiate the audit.
4.5. Methodology to follow The following general methodology rules must be applied during the audit: • utilisation of the checklists; • objective confirmation that one complies with that which is established in the procedures, through dh'ect observations and interviews with the audited party; • evaluation the audited personnel's degree of procedures knowledge; • identification of non-conformities; • establishment of the relation cause-effect for the found non-conformities; • registration of all non-conformities, as well as suggestions for their correction; • communicate to the audited party the conclusions of the audit. The auditing crew will meet directly afterwards with the objective of summing up the verifications made, in order to elaborate a final report: The final report, destined to be presented to the hierarchy of the audited crew. must contain all the elements considered relevant during the audit, pointing out, as well, the solutions in regards to the correction of the detectednon-conformities.
Advances in Safety and Reliability: E S R E L '97
625
5. BASIC ASPECTS TO VERIFY
5.1. At the site where the auditing crew is established 5.1.1. General organisation
Ensure: the good operation of the programming and make a survey of eventual difficulties in their compliance (logistics, lack of material, etc.); the correct management of the means in relation to the number of jobs to execute. 5.1.2. Tools and equipment
Check: the storage; the good apparent state and cleanliness; the equipments and tools control process before their utilisation; the registration of periodical tests.
5. 2. Aspects to verify on the work location 5. 2.1. Regulating and working documentation
Check: • that the executors possess regulative LW qualification; • the correct filling out of the Live Intervention Request; • that the work is being performed by means of the issuing of a written document - Live Inte~a'ention Authorisation, for MV or a Live Intervention Licence, for LV. • the correct elaboration of the Working Plan where one determines the most important phases of the whole process. • the adequation between the preparation and the job to be executed. 5. 2. 2. Preparation o f the L W intervention
This must have the following sequence of actions: Feasibility of the intended intervention: verification of the possibility for the execution, in regulatory conditions. of the required works. Reconnaissance of the work to be performed and the site: following the latter action, the person responsible for the preparation of the job, gathers on the execution site, the set of necessary and fundamental elements for the elaboration of a working plan, namely: • General installation data: the installation's characteristics such as: the nature and section of the conductors, type of poles involved, utilised accessories and equipments, spans upstream and downstream from the intervention, existing unevenness, state of the conductors, etc. • Accessibility to the work site: verification and study of the various existing accesses, not only for vehicles, but also for the transportation of equipments and tools. • Special Exploitation Regimen (specific for MV): selection of the output or outputs to be placed under SER and other measures to be taken, eventually, in order to ensure, throughout the intervention, the permanent compliance with the safety conditions. Necessary material for the intervention: listing of the set of tools and equipments. 5.2.3. Organisation o f the work location
Local conditions: check the positioning of the vehicles; the signalling of the working zones; the placing of tool racks, tarpaulin, service and manoeuvring ropes.
626
N. Mendes
Calculations: check if the mechanical calculations of the line, necessary for the execution of the inte~'ention. have been performed. Equipments and tools: check that one is using the homologated LW tools and equipments. Preparation and discussion of the Working Plan: check that the Working Plan has been discussed and analysed by the whole crew. 5. 2. 4. Personal protective equipment Check that the executor's equipment is found to be in a good state and that it is composed of: helmet (eventually with chin-strap); boots (homologated; rubber, high piped in case of humid ground or half-piped, leather in the case of dry ground); working clothing (waterproof clothing in case of rain); safety harness (aerial jobs); working gloves (LV, two pairs - insulating gloves and mechanical protection type with silicon cuffs); spectacles or face shield (protection against ukraviolet light and arc by-product particles). 5. 2. 5. Collective protection equipment Check the existence and good state of: fuse puller handle (LV); insulating matting (LV); phasing tester; no-voltage detector (MV). 5. 2. 6. Working development Ensure: • that there are no atmospheric conditions adverse to the execution of the job; • that the line is in SER (specific for MV); • that the Crew Chief controls and checks everything which goes on in the Working Zone, namely: checks that the various phases elapse in accordance to the Work Execution Conditions and the defined Operational Processes; warns the executors thatthey may not effectuate changes in the working positions without his express authorisation; interrupts the work and proceeds, with the remaining crew members, with a new analysis of the operations to execute, when an execution problem, different than the one initially foreseen, occurs; checks that everyone has understood his new task. 5. 2. 7. Temporary interruption of the work Check that the Crew Chief has guaranteed the safety of the work location in regards to the public. 5. 2. 8. End of work Check that the job was correctly executed and that the Crew Chief informs the Exploitation Manager of its end.
6. EXPERIENCES
The resuk of the LW safety audits constitute, with other parameters, a factor to the assessement of the contractor' s qualification maintenance. One must, lastly, register that the implementation of the qualification procedures was initiated about two years ago has been considerably well accepted by the service providing companies, as this gives them a better guarantee over the functionality of the rules of competition. In this way they know that they stand in a perfect level of equality in regards to the minimal requirements demanded by the contracting company, independently of the territorial location and the department which promotes the adjudication.
A d v a n c e s in Safety and Reliability: E S R E L '97 REFERENCE LIST
Filipe, J. Vilar- Auditorias de Seguran~a "lngenium", November 1987 NP - 2269 (1985) - Garantia da Qualidade - Auditorias da Qualidade Herranz, A. P. - Audits des t~quipes de Travaux sous Tension en Espagne "ICOLIM' 94" Lombardet, D. - Audit des Unit~s Op&ationnelles "ICOLIM' 94"
627
B9" Industrial Safety
This Page Intentionally Left Blank
TECHNICAL CERTIFICATION OF DANGEROUS EQUIPMENT: A STUDY OF THE E F F E C T I V E N E S S O F T H R E E L E G A L L Y C O M P U L S O R Y R E G I M E S IN T H E NETHERLANDS
A..R. Hale ~, C.M. Pietersen:, B.H.J. Heming ~, B. van den Broek s, W.E. Moi s, C. Ribbert ~
Safety Science Group, Delft University of Technology, 2628 EB Delft, NL : AEA Technology Netherlands B.V. 2514 AB Den Haag, NL 3 Dutch Institute for Working Conditions (NIA-TNO), 1070 AR Amsterdam, NL
ABSTRACT As part of the process of introducing more decentralisation and market forces in the area of safety and health regulation, the Dutch Ministry of Social Affairs is planning changes to the certification regimes for lifts, cranes and pressure vessels. This paper reports a study commissioned to evaluate the effectiveness of the regimes of periodic inspection and certification in the past and to make recommendations related to introducing competition between certifiers for in-service certification. The study found very little statistical evidence relating to the regimes. What was available, and the opinions of the interested parties leads to conclusions that the current regimes work well as a contribution to technical safety. A number of recommendations are made about improving the regimes and safeguarding their achievements if more competition is introduced. The paper ends with a brief summary of the Dutch government proposals based on the research.
KEYWORDS Technical certification, lifts, cranes, pressure vessels, risk graph.
INTRODUCTION Compulsory inspection of equipment has been used as a safety measure for more than a century. Three types of equipment which are subject to such inspection almost universally are pressure vessels for steam and other chemical substances, either in gaseous or liquid form, lifts (particularly those for the carriage of persons) and cranes and other lifting gear. In the Netherlands all three are subject to periodic inspection by one centrally designated certification agency. Changes in the European regulations for these three types of equipment, and a reconsideration of the role of the government in regulating safety led the Dutch Ministry of Social Affairs and Employment to reconsider the regulations in force in the Netherlands governing these inspection and certification regimes. A research study was commissioned to evaluate the effectiveness of the existing regimes (Pietersen et al 1996). In particular the Ministry was interested in the need for any changes in the criteria for certification and the organisation of the regimes themselves in the light of possible opening up of certification to competing certifying bodies in a free(r) market. With the introduction of the European CE-mark for bringing products onto the European market, national governments lose the ability to require separate certification of manufactured equipment, since this would reintroduce trade barriers. The CE-mark is regulated by standards under Article 100A of the European Treaty and is-" put on equipment by the manufacturer, in certain cases, including for the three types considered here, once the 631
632
A.R. Hale et al.
equipment has been tested by an independent certifying body. These notified bodies (nobo.s) re accredited in each of the European states and their approvals are valid for the whole European Union. Only once the equipment has been taken into use may national governments require additional standards or certificates, under Article 118A of the European Treaty. Among such certificates are the periodic inspection regimes which are dealt with in this stud3. These may include an inspection at the time of taking into use of the equipment if it is constructed (e.g. tower crane. combined pressure vessels in one plant).
F R A M E W O R K FOR THE STUDY A periodic inspection regime can be described as a number of steps as shown in figure 1. All these must be effective and efficient in order to make the regime both safe and cost-effective. Evaluation of the regime
I
Eventual certification at taking into use
Manufacture and Installation
I
Definition of certifiable object
-- Registration
I Certification criteria
I
.
.
.
.
.
.
.
.
.
I
.
Accidents, defect analysis & user satisfaction
Expertise Frequency Methods
~ Certification -¢ Poor----* Improv & re-certification
- Re arting
Figure 1" Framework for a periodic inspection regime
The study formulated questions about the following areas to provide the basis for data collections and interdews about the different steps: 1. Are all the appropriate types of equipment covered by the legal requirements, based on how dangerous they are? 2. Is all the required equipment registered for inspection and certification? 3. Are the inspection criteria appropriate: clear and covering the factors which lead to accidents? 4. Is the frequency of inspection appropriate and is it kept to? 5. Are the available expertise and methods of inspection satisfactory? 6. Are a significant number of (serious) defects found and corrected? 7. Are there accidents with the types of equipment which can be traced to the functioning of the regime? 8. What would the expected effects be of removing the inspection monopoly and introducing competition?
METItOD
The study was conducted using interviews of the actors in each certification regime; the certifying body with a monopoly of the legal inspection, other certifying bodies doing similar work, manufacturers, users of equipment (employers and employees), regulators. The records of the certifying bodies were studied to extract data about the effectiveness of the regimes in so far as this was possible. It is particularly worthy of note that none of the certifying bodies had their data available in a form which could be easily analysed; most was not computerised, and there was no consistent classification of the types of defects found during inspections. This necessarily limits the quantitative results which can be presented. Arrangements were made for a more detailed study of a sample of the card records of the pressure vessel certifying body. The records of all 427 deviations found during inspections between 1976 and
Advances in Safety and Reliability: ESREL '97
633
1991 were analysed for type of failure and, for some categories of equipment, when that was detected (by periodi inspection or during use). Secondly a random sample of 450 of the approximately 140,000 individual record card: coveting 1506 inspections were analysed to find estimates of the percentage of periodic inspections whic discovered deviations. Some results of this analysis are presented below. The records of the crane certifier could nc be studied because the organisation was in the process of moving premises. The lift certifier was not willing to grar access to the records for reasons of commercial privacy. The results of the study were presented to and discussed with the regulators and later a workshop of all intereste parties.
RESULTS Table 1 gives a summary of the way in which the regimes are currently organised and the number of inspections ant certification which are conducted on average each year. This table refers only to the compulsory certification regim~ and not to additional voluntary inspections. Data on results is taken from annual reports, except in the case of th~ pressure vessels, where results of the sample survey are used.
Table 1: Summary of the certification regimes and their results
Objects Monopoly certifier Equipment falling under compulsory periodic inspection Frequency of inspections
Lifts
Cranes
Pressure vessels
Liftinstituut lifts where cage can be used by a person. Travel vertical ± 15" taking into use, after 12 months and then every 18 months
Aboma/Keboma > 10ton meter
Stoomwezen Vessels for steam and other gases and liquids under pressure
taking into use, after 3 years and then every 2 years + modification and repair 3200 Legally required inspection by competent person for all cranes > 2 ton every 12 months, done by other certifying bodies, and trained personnel 70%
Every 1, 2 or 4 years depending on type and contents
Approx. no. inspect/year Other certifiers and certifications in area
37,000 Non-compulsory inspections by other certifying bodies
Results1: % OK at first
47%
inspection % OK after immediate correction % uncertifiable or requiring major correction Number of dangerous situations reported to Ministry (1995)
13.000 User inspectorates of large firms (esp. in process industry) carry out inspection under supervision of Stoomwezen
91.2%
50% (Mainly door contact problems, no safety implications)
26%
7.5%
3%
4%
1.3%
I0
38
IFor lifts and cranes data is from 1995; for pressure vessels it is from the random survey of cards over 1976-91 (see above) Table 2 gives the results of the interviews with the interested parties in relation to the questions set out above.
634
A.R. Hale et al. Table 2. Interview results on research questions
Objects 1. Are all the appropriate types of equipment covered by the legal requirements, based on how dangerous they are? 2. Is ,all the required equipment registered for inspection and certification?
Lifts Users satisfied on this point, despite lack of accident data
Cranes Multi-functional excavation equipment not covered. Otherwise users satisfied with what falls under regulations
Pressure vessels Satisfied for individual vessels. Concern over combinations of vessels constructed on site & not subject to start-up insp.
Overview lost since 1995 as registration of new lifts no longer compulsory. Concern about lifts in small housing blocks.
Overview may be lost as from 1997, since certification on taking into use of new cranes may cease then
Some under-registration in horticulture of N2 vessels. Overview will be lost when compulsory inspection of new vessels
3. Are the inspection criteria appropriate: clear and covering the factors which lead to accidents?
Standards are realistic. Some small interpretation differences. Accident factors for maintenance & installation not covered. Technical factors covered (except cage closure on pre-1978 lifts) Satisfactory. Much additional inspection on voluntary basis
Standards are realistic, but a clear CEN norm is needed to ensure harmonisation. Accidents mainly due to operator error or violation. Ergonomic aspects not covered. Satisfactory both tbr compulsory, by Keboma and 12 monthly by trained expert. 12 monthly by certified body perhaps desirable. Frequency based on hours used instead of calendar time perhaps desirable. Generally satisfactory. Manuthcturers doubt upto-date expertise of certifying bodies and argue for manufacturer certification Yes. Contribution of regime to safety not questioned
Standards are realistic. Some interpretation differences across inspectors and regions.
No reliable data. None known by interviewees. Accidents mainly due to operator error
No reliable data. None known by interviewees.
Need for clearer CEN
Need for rules on riskbased inspection criteria. Client-orientation should increase. Loss of overview of equip.
ceases
4. is the frequency of inspection appropriate and is it kept to?
5. Are the available expertise and methods of inspection satisfactory?
Yes
6. Are a significant number of (serious) defects found and corrected? 7. Are there accidents with the types of equipment which can be traced to the functioning of the regime? 8. What would the expected effects be of removing the inspection monopoly and introducing competition?
Yes. Value of regime not questioned.
No reliable data. None known by interviewees. Accidents mainly in installation, maintenance and inspection Need for clearer norms. Expect more clientorientation. Loss of centre of expertise
norm.
Competition welcomed. Possible loss of concentration of expertise.
Satisfactory, given flexibility with which certifier grants extensions for well argued reasons. Formalisation of criteria for risk-based inspection necessary
Yes. User inspectorates argue for regularisation of their position and a greater role in inspection
Yes. Value of inspection regime not doubted
Advances in Safety and Reliability" ESREL '97
635
The overview of what equipment falls under the regulations will disappear with the loss of the monopoly, since the requirements frr registration of new equipment have ceased, or will cease. Only at the time of compulsory user certification will registration take place with one or other of the approved certifying bodies and no system of reminders for certification will therefore be possible. The government appears to have no intention of requiring this, despite the problems this may cause for tracking down equipment which may more easily slip througJa the net of inspection as a result. This was seen by interested parties as a negative effect of the removal of the requirement for inspection before equipment can be taken into use, coupled with the introduction of the CE-mark. A further concern in that respect was the adequacy of the European supervision of the uniform quality of independent inspection of new equipment carried out by nobo's in all European Union countries. Users had a certain suspicion for equipment not certified by bodies known to them. It should, however, be pointed out that any user retains the right to require additional certification of any equipment purchased by himself or used under contract to him. It is to be hoped that the value for society as a whole of the retention (and indeed extension) of an overview.of the equipment and its hazards, as a means of monitoring safety and as a feedback to designers and users of equipment, may be able to prevail over local opposition and the apparent government indifference to this issue. Apart from minor concems with the existing regimes, the users were more motivated that any new regulations and the introduction of market competition should not jeopardise the advantages of the existing systems. Competition was felt to offer the advantage that certifiers would be more sensitive to client needs and demands, but the danger was realised that it could threaten the level of safety, if the criteria and procedures for inspection and especially for the granting of any extensions or exemptions were not clearly specified; perhaps even more clearly than is now the case. The danger therefore lurks that decentralisation of regulation could result in pressures for increased bureaucratisation and even thicker rule books and standards in order to preserve harmonisation. A general concern for all three regimes was expressed, that removal of the certification monopoly could threaten the level of expertise built up by the certifying bodies, which could result in the longer term in a "loss of memory" for less frequent and older problems. Finally the study revealed underlying issues about who should be allowed to certify equipment. The manufacturers of lifting equipment felt that the technical expertise of engineers not employed by them could never keep up-to-date with new developments as well as they could. On the other hand others doubted the independence of manufacturers. In the area of presstire vessel inspection a similar concern about the role of user inspectorates was the subject of strong debate. The independence of their inspections is currently guaranteed by supervision of their programmes and reports by the certifying body. When this monopoly is removed it is not clear whether this role should be taken over by the Dutch Accreditation Council which also accredits certifying bodies, or whether certifying bodies should take it on. The former arrangement would make user inspectorates in more ways the equivalents of certifying bodies in their own fight; the latter would create the anomalous position that certifying bodies were being asked to assess potential rivals for their direct certification business.
GOVERNMENT PROPOSALS At a workshop in October 1996, at which the results of the research study were reported to the interested parties the Ministry set out its proposals for the new regime of periodic certification in the light of the findings and its general policy (Ministry of Social Affairs & Employment 1996b). The comments and recommendations of the research were accepted except that: !. Criteria relating to user comfort, working conditions for installers, maintenance personnel and inspectors and ergonomics, c.q. error prevention for operators were not seen to be appropriate matters for regulations about periodic inspection, but for employer-employee agreement. 2. The need for a central register for equipment was not seen as a problem. 3. Concerns over nobo's from other countries were felt to be soluble by users making their own agreements with suppliers over what certificates to accept.
636
A.R. Hale et al.
From the analys~s of the pressure vessel records some idea could be gained of the origins of the failures. The analysis was complicated by the lack of data on the total number of pieces of equipment in the population in different subcategories (e.g. by type of metal for construction). It was also not always possible to distinguish defects discovered during periodic inspections and those found when the certifier was called in after the user had detected a possible defect and wished to have it checked (Stoomwezen had no monopoly on that sort of inspection). Table 3 indicates the sort of data which can be obtained from the analysis of the defect records.
Equip. type Inspection Design error Manu. Error Use error Corrosion Stress corr. Erosion Creep Fatigue Other Total PV = Pressure Div. = diverse.
Table 3: Origins of failures LPG LPG PV PV (P) (O) (P) (O) . . . . .
detected in periodic (P) Stor. Stor. HE (P) (O) (P) . . . .
and other (O) inspections HE SR Boil Pipe (O) (O/P) (O/P) (O/P) . 2
Div. (O/P) 2
Tot. (O/P) 4
5 17 7 6 1 l 5 5 15 32 6 l O0 7 34 l I1 2 3 7 28 7 2 I02 3 9 3 3 1 3 2 12 9 45 3 2 4 4 2 3 7 9 I1 2 i 48 . . . . . . . . 2 l 2 5 2 . . . . . 6 16 22 46 1 7 5 5 10 13 14 2 57 1 3 1 2 2 i 5 5 20 19 66 25 31 4 2 6 23 42 101 95 13 427 vessel, Stor. = storage tank, HE = Heat exchanger, SR = steam receiver, Boil. = all types of boiler, Use error combines the categories "operations", "wrong use" and "over-pressure" from the forms.
For the equipment where data is available on the type of inspection that uncovered the defect, 30% of the known defects were discovered at periodic inspections.
CONCLUSIONS FROM THE FIELD STUDY The study demonstrated a remarkable degree of satisfaction with the current regimes for technical certification in the Netherlands. All parties pointed to the relatively high percentage of defects found by the regime and the low numbers (if not absence) of accidents from technical failures in the three types of equipment. Frequent mention was made of the preventive working of the compulsory regimes, leading to more voluntary inspection and corrective actions so that expensive equipment was not laid still at the legal inspection. What is remarkable, however, is that this satisfaction seems to be based almost entirely on qualitative and subjective assessments. None of the regimes could produce easily comprehensive data to prove the worth of the inspections; none could demonstrate clearly what types of defects were discovered, not whether these had any implications for the design or use of the equipment. In other words the regulatory system durently has no systematic feedback and learning loop based on data analysis by which its effectiveness can be assessed, nor whereby proposed changes in it can be objectively evaluated. A reliable register of accidents with the equipment types (either by the certifiers or by the Ministry) is not currently available. The value of analysis of incident and defect data was shown by one user inspectorate for pressure vessels, which was able to demonstrate the value of its inspections, track the results of changes in frequency and make proposals for improvements on the basis of its (unfortunately confidential) data. The analysis of the sample of the pressure vessels records carried out during this research showed that much better classification and population data were necessary in order to formulate clear preventive strategies to reduce the number of defects, but that the high proportion of manufacturing errors is striking. A national system of analysis of inspection data would be worth establishing, if it were computerised and gave rather more depth of causal information. The incipient removal of the monopoly of periodic inspections will make this more difficult to set up, since more certifying bodies will have to be persuaded to collaborate.
Advances in Safety and Reliability: ESREL '97
637
The main feature of the government's proposals for regulation is a more consistent use of risk-based regulation. The type of certification regime to be applied would be decided by application of a risk graph (Figure 2) which w e i ~ s ,,the estimated probability of failure of the equipment (F), the likelihood that someone is in the vicinity if it fails (B) and the maximum expected effect of failure (E).
E1 E2 E2 E3 E3 E4
.......... ....... ..... ......
B1 B 2 -~-B1 B2 ......
F3 1 2 3 4 5 6
F2 0 1 2 3 4 5
F1 0 0 1 2 3 4
Figure 2: Risk graph for deciding certification regime Where: F 1 = very small chance. Not sensitive to ageing F 2 = small chance, fails functionally rather than catastrophically F 3 = relatively large chance. Sensitive to ageing B 1 = Persons seldom in danger area B 2 = Persons often or always in danger area
E E E E
1= 2= 3= 4=
Slight injury Permanent disability/1 death Several deaths Catastrophic. Many deaths
The proposed regimes are divided into 0-3 = no legal requirement for certification, 4-6 increasingly tight legal requirements" 0 = Voluntary inspection by persons after instruction and training 1 = Voluntary inspection by experts appointed by the employer and specially trained 2 = As 1, but inspectors have an independent position to those with an interest in the results. Training on approved courses 3 = As 2, but criteria such ,as EN 45012/ISO 9000 or EN 45004 applied to independent user inspectorate 4 = Compulsory legal certification according to government approved rules by independent expert certi~,ing body accredited under EN 45011 by Dutch Accreditation Council. Possibility for technical part of inspection to be delegated to certified user inspectorates 5 As 4 but no delegation of technical inspection permitted 6 = As 5 but with close government super~'ision, or carried out by the government. For Class 3 the government would reserve the right to require certification based on other arguments than those represented in the risk graph (e.g. environmental damage, practical experience, regimes in surrounding countries, political, economic or employment reasons). This preserves a region of discussion. In the first working out of the classes for the three types of equipment the Ministry comes no higher than class 4 for any Of them. Lifts for persons would fall in class 4, unless they can only carry one person (class 3). This would represent only a minor relaxation of the current compulsory legal certification. The only cranes which warrant class 4, according to the proposals, is that for lifting persons more than 3 meters. The current equipment which must be compulsorily certified would only reach class 3 and would fall into the voluntary sector; however the government proposes to use the additional arguments cited above to retain it in the compulsory sphere. Pressure vessels for all purposes would be grouped in class 4 above a certain volume and pressure level, which would vary per material contained in the vessel; the chosen limits would shift some equipment across the boundary of compulsory certification.
Comment The use of a risk graph seems a sensible method of bringing a certain nuance into the certification requirements. Such a graph has been used in other application for machinery standards and is proposed in the new Dutch approach
638
A.R. Hale et al.
to risk-based regulation proposed for all legislation in the area of working conditions. The main area of discussion in the use of such a graph is the interpretation of the categories. In particular what are regarded as slight or significant chances of failure, and whether the expected maximum effect should be interpreted as a "maximum credible ~-accident" or the maximum that has occurred according to records in the country concemed,-or some other more conservative criterion. In respect of the latter it is striking that none of the equipment is rated as having a potential effect above E 3; i.e. none is rated as having catastrophic potential, despite known cases of tower cranes collapsing on crowded streets or major explosions after vessel ruptures. The risk graph therefore, gives much food for discussion. It can contribute to clarifying the factors which lead to decisions to subject equipment to one sort of regime or another, but will demand intensive and careful discussion with all parties concerned to arrive at consensus. The rejection of the need for legal regulations conceming criteria other than construction requirements in periodic inspections seems to be a reflection of the current Dutch policy to limit government intervention in regulation to clearly provable issues of major safety concem. The fact that the ergonomics of crane controls and the provisions for the protection of lift maintenance staff can easily be checked at periodic inspections is a matter which the government wishes to leave to interested parties to include in the criteria if they wish. The mechanism exists for this to be realised through the influence exercised by standards committees and advisory boards of certifying bodies in modifying and approving the certification procedures and criteria for their work
REFERENCES
Ministry of Social Affairs & Employment 1996b. Goed keuren? SZW op zoek naar een samenhangend keuringsbeleid. (Good certification? Social Affairs in search of a co-ordinated certification policy). Den Haag. Ministerie van Sociale Zaken en Werkgelegenheid Pietersen C.M, Hale A.R., Heming B.H.J., v.d. Broek B., lViol W.E. 1996. Evaluatieonderzoek periodieke gebruikskeuringen van arbeidsmiddelen . (Evaluation research of the periodic certification of work equipment). AEA Technology. Den Haag.
ENVIRONMENTAL R I S K A S S E S S M E N T OF C H E M I C A L PLANTS: A PROCESS SYSTEMS METHODOLOGY
S.K. Stefanis, A. G. Livingston and E.N. Pistikopoulos Centre for Process Systems Engineering, Department of Chemical Engineering hnperial College, London SW7 2BY, U.K.
ABSTRACT
A Methodology for Environmental hnpact Minimization (MEIM) of routine and non-routine releases is presented in this paper. The methodology, which embeds environmental impact assessment techniques within a process optimization framework, involves proper definition of a consistent boundary around the process of interest, identification of the emissions inventory, quantification of environmental impact via proper metrics and inclusion of environmental criteria within process modelling and optimization tools. Interactions between cost and routine/non-routine environmental impact objectives are explored while implications for maintenance policies are also investigated. The steps of the theoretical analysis and the potential of the proposed methodology are illustrated with a simplified chemical process involving methane chlorination.
KEYWORDS
Environmental impact; non-routine releases; process optimization; preventive maintenance.
INTRODUCTION
Environmental risk assessment is typically concerned with the estimation of the damage caused to humans by hazardous pollutants and is traditionally defined as the likelihood of an adverse health effect, such as a carcinogenic death, due to an exposure to an environmental hazard (Lapp, 1991). Yet, little emphasis has been given to environmental effects such as the actual air or water damage, ozone depletion etc. Christou (1996) proposed a framework for developing an integrated approach for environmental risk assessment, which relies on qualitative hazard identification techniques (such as HAZOP, FMEA, see Montague, 1990). This approact, focuses on post release calculations (i.e. fate of pollutants and their health effects) rather than the actual source of pollution and its causes, either intended or unintended, which for process plants are strongly linked to aspects of plant design and operation. Environmental risk management is currently performed at the post assessment level in an iterative fashion based mainly on operational aspects of t,he plant in question (HMSO, 1995), using health but not environmental indicators (Sarigiannis and Volta. 1996). Currently, there is no formal process optimization based approach to fully explore the interactions between process design, operation (including maintenance) and environmental impact due to risk and unexpected events. Recently, we introduced a Methodology for Environmental Impact Minimization (MEIM) which embeds Life Cycle Analysis principles (LCA) within an optimization framework for continuous as well as batch processes (Pistikopoulos et al.. 1994; Stefanis et al., 1996) to quantify the environmental impact of routine releases. The main steps of MEIM, include: (i) definition of a process system boundary, (ii) environmental impact assessment on a short or long term basis and, (iii) incorporation of environmental impact 639
640
S.K. Stefanis et al.
criteria explicitly as process design objectives together with economics in a multiobjective optimization setting. MEIM is an effective tool ibr a rigorous assessment of the interaction between industrial technology and the environment, helping identify design and operation options to reduce pollution at source by minimizing process routine releases. A key characteristic of non-routine releases is that they are often related to equipment failures and the probabilistic occurrence of external events, such as unexpected leaks and human errors. Industrial risk frequency graphs indicate that non-routine releases can significantly influence the environmental damage related to a process system. Unlike extreme cases such as major accidents (occurring at very low frequencies with serious consequences) and routine releases (highly frequent causing minor environmental damage), non-routine releases, placed in between, often cause moderately severe adverse effects and may thereibre result in considerable risk levels. This necessitates the development of an integrated framework that will properly account ibr non-routine process waste generation due to "unexpected/undesired" events while simultaneously assessing the environmental impact of routine waste releases. Since the environmental impact of a non-routine release depends on its probability of occurrence, the machinery of reliability theory can be employed to provide such a ibrmal link, as for example used in the FR.AMS methodology (see Thomaidis and Pistikopoulos, 1995). Summarizing, the objectives of this paper are: (i) to quantify principles of MEIM so as to provide an integrated and rigorous framework to assess in a systematic way the adverse effects of industrial processes on ecosystems during normal as well as ab-normal conditions, (ii) to study the effects of plant design and operation on the environmental impact of Routine and Non Routine Releases, and (iii) to establish the fundamental theory and computational tools to arrive at cost optimal designs featuring minimum environmental impact via the use of multiobjective optimization techniques. METHODOLOGY FOR ENVIRONMENTAL ROUTINE RELEASES
RISK ASSESSMENT
OF ROUTINE/NON-
In the context of this work, Environmental Risk (ER) is the measure of potential threats to the environment taking into account that undesired events (scheduled/unscheduled) will lead to environmental degradation. Qualitatively, Environmental Risk represents the probability of environmental damage due to undesired events multiplied by the severity of the environmental degradation. In accordance with the principles of MEIM, the system boundary around the process of interest is first specified. Concentrating mainly on process waste generation, the following framework for minimizing routine and non-routine releases is proposed (see Figure 1).
RoutineReleases (Processinwastes) g
Non Routine Releases
(leakage.s,fugitiveemissions,accidentalreleases, off-specproduct)
~CHyCIz, NOx, HCI, CI z ..~.
............
..................................................... Environmental Limits
, Rvli'~bility/Maintenance Data
Envlrorlrnental Impact Indices
[CTAM] --] [c'rwM] ~_ Shot/Term Basis [SMD] Global Warming [GWI] Photochemical Oxidation [POCP] Stratospheric Ozone Depletion [SODP] ~_ LongTermBasis Ultimate Air Pollution [UCTAM] Ultimate Water Pollution [UCTWM] Ultimate Solid Waste [USMD]
] ,~'/~
Air Pollution
Water Pollution Solid Waste
Impact Azsessm~nt
Figure 1: Environmental Impact Assessment of Routine/Non-Routine Releases
Advances in Safety and Reliability: E S R E L '97
641
ROUTINE AND NON-ROUTINE EMISSIONS INVENTORY The process of interest is examined in detail to determine wastes that are regularly emitted into the air, aquatic or soil enviromnent and various non-routine releases such .as: 1) Accidental Releases mainly due to the occurrence of scenarios such as leakage, equipment failure, human error, etc. 2) Fugitive Emissions that involve small leaks or spills from pumps or flanges and are generally tolerated in industry. 3) Releases fl'om Process Deviations caused during start-up, shut-down, maintenance procedures and also from changes in operating conditions (temperatures, pressures) and various plant parameters such as feed variations. 4) Episode Releases as a result of sudden weather changes or other occurrences. The overall inventory is represented by a waste vector, as shown in Figure 1, which consequently needs to be assessed. ASSESSMENT
OF ENVIRONMENTAL
DAMAGE
All routine and non-rolttine releases are often grouped systematically in terms of the environmental damage caused on a short or long term basis. For the fully operable state (routine process system status), the Environmental hnpact (EI) vector shown below represents the damage caused to the environment during intended plant operation on a time basis (usually one hour of operation, ignoring pollutant intermedia partitioning), i.e. the environmental impact of routine releases: I,V
EI = ~ "lv~
T,V
EI.,, = ~ [CTAMw C T W M w S M D w GWIw POIw SODI~]p~oc~ T 1
(1)
"lu-- 1
comprising indices that measure air pollution CTAM [kg air/h], water pollution C T W M [kg water/h], solid wastes SMD [kg solids/hi, global warming GWI [kg C02/h], photochemical oxidation POI [kg ethylene/It] and stratospheric ozone depletion SODI [kg C F C l l / h ] for eachwaste w, depending on current legislation limits and the mass of pollutant disposed 1. When an equipment failure or an event which causes the system to significantly deviate from its normal operating status occurs, this defines a new operating state for which a corresponding environmental impact, similar to (1), can be computed. This new operating state will have an associated probability of occurrence, which in general will be a function of equipment reliability models and other data (maintenance, safety events, statistical charts for spills, ere). We denote the set of potential discrete operating states in which a process system can reside over its operating time horizon H as state space K, with a corresponding probability pk(t), k 6 K, where t denotes time (since the reliability of the processing system is a function of time). A combined environmental impact vector ibr routine and non-routine releases, CRNREI, can then be introduced, to represent the average environmental damage of a given process design during normal and unexpected operation within a specified time horizon [0,HI as tbllows. STEP
1 :
(a) Define all operating states K of a process system (b) Determine corresponding environmental impact vector (E/k), k E K from (1)
STEP
2 :
(a) Estimate the reliability (unavailability) of each part of the equipment as a function of time, Rj(t) [Qj(t)]. For example, ifWeibull functions are used to describe equipment reliability,
R.j(t) - .
'weif(cT;~j) dt, j • Sk Q~(t).
= .
weif c~j ;/3j) dt, j e-~k
(2)
where. S~:(S~:) is the index set for operational (failed) components of the equipment in state k and c~; ~ are the scale and shape factor of the Weibull function. (b) Determine the probability of each state k, e.g. assuming statistically independent equipment failures" Pk(t) = I-[ Ri(t) r I Qj(t) k e g (3)
j~s5
j~
~these indices rely on the linear contribution assumption of pollutants; extentions to include fate considerations are described elsewhere (Stefanis, 1996)
S.K. Stefanis et al.
642
S T E P 3 : Calculate the Environmental hnpact Vector as a function of time, EI(t)"
EI(t) = ~ Pk(t)EIk
(4)
kEK
S T E P 4 : Determine the combined Environmental hnpact of Routine and Non-Routine releases for a given time horizon H. 1
1
CRNREI = -~ ./, EI(t)dt = -H ./H ~ Pk (t)EIk
(5)
kcK
Qualitatively, this vector represents the average environmental impact of the process design over all possible system states within a specified time horizon H. Therefore, it measures the overall system environmental pertbrmance under both expected and unexpected events. The closer this vector is to the Environmental hnpact vector of the initial state (denoted here as fully operable state o), the lower environmental risk the system conveys. Note that the Environmental hnpact vector attributed to Non-Routine releases, NREI, over the time horizon can be easily computed as ibllows:
N R E I k = EIk - EI °
k EK
(6)
where EIo is the Environmental hnpact metric corresponding to the fully operable state, i.e. it denotes routine waste releases.
NREI(t) = ~ Pk(t)NREIk
(7)
kEK
N R E I = -~ 1 IHNREI(t)dt= -~ 1 fH ~ Pk(t)NREIkdt •
"
(8)
kEK
Qualitatively, NREI represents the average environmental impact due to non-routine releases. For the fully operable state from (6), NR,EI=0, as expected. S T E P 5 : Design ()ptimization ibr Minimum Environmental Impact and Environmental Risk (optional). The combined environmental impact vector, as defined above, provides an accurate estimate of the average environmental peribrmance of the system taking into account both routine and non-routine releases. In the analysis presented so far, decisions regarding the process design itself (for example, volumes of equipment) were considered fixed. A subsequent question is then, how to obtain a minimum cost design, while ensuring that the system is capable enough of keeping routine and non-routine release levels as low as possible. Conceptually, this problem can be posed as the following multiobjective optimization problem (9) using the e-constraint method (Hwang, 1979): min cTy + F(x)
(9)
x,y
s.t.
h(x) = o, ~(x) < o,
B . y + C . x < _ D,
1/. ~
NREI(x,y) = -~
•
CRNREI(z,y) = -~
~ Pk(t)EIkdt < e •
xEX,
Pk(t)(EIk - EI°)dt
kEK
kEK
y E Y E { 0 , 1 } T~
The continuous variables x represent flows, operating conditions and design variables. The binary variables y denote tile potential existence of process unit blocks and optionally streams, interconnections, e is a parameter vector that imposes stricter legislation on pollutant discharge. These variables typically appear linearly as they are included in the objective function to represent fixed charges in the purchase of process equipment (in the term cT.y) and in the constraints to enforce logical conditions (B.y+C.x
~ ~Safety Information ~ G~Ved:::t/
~flndustry Consensus~
Standards j
I
I
Assessment ~~raini~
/-- T --~ ~~roced~._.~ !
i
~
Integrity
~ ~ K
~ '
i/
The system consider an open architecture, object oriented development system. It allows trained user's to quickly develop powerful performance support and training modules for control room operators and other operating personnel. It could integrate "point-of-need" access to critical operation control, and safety information management. This enable employees to do their job more efficiently and safely. Open architecture This approach provides an easy-to-use and learn graphical interface allowing user's to logically define information types for quick retrieval. Through user-defined menus and targeted graphical displays the user can rapidly call up: process safety information, material safety data sheets, process overviews, plant photos,
Advances in Safety and Reliability: ESREL '97
655
other types of information, e. g. graphics, Autocad diagrams, Intergraph and word processing document and graphics, digitized video, sounds, animation and link to databases. Users do not have to re-create currently available documents. They can use existing formats quickly and effectively. The PSAM approach provides Dynamic Data Exchange, Object Linking and Exchange and Dynamic Library Linking support for full connectivity to other sot~vare and access to network databases. The system provides on-line help and decision support including pop-up procedures when connected to DCS systems and serves as an infrastructure to support future dynamic process simulation and computer-based training models. Object-oriented information management This approach: - provides a new and better way to develop, incorporate, retrieve and re-use the enormous varietiesand amounts of Site-specific process-related information; uses a simple way of assigning information and data types to classes (controllers, indicator, valves, pumps, exchangers, sections, vessels, personnel, process areas etc). -
What does the company world look like? The system allows to look at the entire corporation, perhaps just one region, or, most likely, a single site with various manufacturing areas within it. If you are mainly interested in training in one area of the site, consider what other information may be needed in that area. If you are working in only one area, are there other areas of the plant that might also want access to the material you develop? The suggested approach allows to use a "wide-angle" view when determining how to define the world of the system to be developed. Who will develop the site's system? A long term advantage is that using the suggested approach the development of the system enable a large cross-section of the company organization to work together. A designated engineer or integrator, working to company standards, should be assigned. He/she would be responsible for integrating the various components into logical subject areas, developing menus, organizational structure, and overall links to information. Who will access the system? Access can be made available to anyone chosen at company site. This would include employees such operators, technicians, engineers and secretaries. Since users must be registered and assigned a password and access level, access to various parts of the system will be dependent upon their expected use. End user End users can access the informational and training subject areas, viewing and learning about vital process safety information, emergency procedures and general process control information. Users can be trained at their own pace, even on-shift. Performance and qualification tests can be integrated into the lessons. Or, a test can be linked to a management Of Change (MOC) document to ensure that people can understand it. The system Post Office feature allows administrators to send messages to end users about MOCs or other important issues; relevant files can be attached to messages, so a message about MOC could have the actual MOC and related quiz send with it. Administrators can the monitor who read their messages, who opened the associated files, who completed related quizzes, etc. tests and learning modules can be assigned, scheduled, and tracked within the system environment. Results can be tracked with hard copies provided through the Report feature.
656
C. Fiorentini et al.
An alarm manager can be integrated with DCS, with specific alarms being linked to relevant information. When the alarm is generated, the linked information is displayed. It basically provides on-line, situationspecific help for users.
4
CONCLUSIONS
Abnormal plant operations cost the US process industry over $20 billion. About five major losses occur each year, but much of the costs is due to numerous minor upset that mean lost time, equipment replacement, lessened quality, pollution and so on. Each one also has the potential of becoming a major catastrophe. According to studies of process upsets are, almost half are caused by people-related factors such as insufficient procedures, incorrect actions and inadequate work practices; equipment and process related causes ranked second and third, respectively. In follow-up incidents reports, two recommendations emerge: companies should establish and distribute new procedures, and conduct better training. The spirit of UE Directives, OSHA and EPA regulations is to make companies arm workers with the latest, correct information so they can quickly intervene in a potentially serious potential upset and prevent it from turning catastrophic. These regulations not only requires that employees or their representatives have access to information regarding hazardous materials in a given facility, they also require that processing facilities develop and implement a training program and maintain applicable training records. The approach presented was designed to address the information and training needs of companies that must comply with these new regulations for a quick and efficient implementation of a computerized system to meet all the requirements including: Process Hazard Analysis (PHA), normal (SOP), abnormal and emergency procedures, Material Safety Data Sheets (MSDS), Management of Change (MOC), and Hazardous Operations. These documents, must be up-to- date, ready, and easily accessible. The process safety management: performance support and training system presented allow an integrated, easily-accessible, point-of-need source of the information workers need in order to respond quickly and correctly. Armed with the right information and reacting quickly, life threatening situations, spills or leaks can be avoided or lessened. Downtime to repair the damage caused by accidents can be minimized, as workers respond more rapidly to process upsets with the increase of safety level.
BIBLIOGRAPHY
(1) (2) (3) (4) (5)
(6) (7) (8) (9)
Cullen Lord (1990), The enquiry into the Piper Disaster, HMSO Drogaris, G. (1993), Lessons Learned from Accidents Notified, UE - JRC - ISPRA - VA - Italy Nimmo, I (1996), "ASM" Abnormal Situation Management, - PRISM '96 Users's Conf. - Houston TX EEC Directive (on the major accident hazards of certain industrial activities ) - Adopted in 1982) (..) The essential requirement under the CEC proposal remain the Safety Report for the larger establishment covered by the proposal, submitted by the Competent Authorities: This Safety Report will have to include a completely new section on Management Systems and Organization of the establishment European Parliament "Industrial Hazards: the Seveso Directive - Project Paper N. 1 Luxembourg, 29 April 1993 (Doe. PE 171.126). Council Directive of 12 June 1989 on the introduction of measures to encourage improvements in the safety and health of workers at work. Council Directive: 89/654; 89/655; 89/656; 90/269; 90/270; 90/334; 90/679 and 91/383. Ielasi, R (1995), "Ambiente, Qualith, Sicurezza: Un approccio integrato" - 3ASI - Milano Courtesy of Atallah S. - 1995
AN INVESTIGATION OF THE CONCEQUENCIES FROM POSSIBLE INDUSTRIAL ACCIDENTS IN NORTHERN GREECE Ioannis C. Ziomas ~, A. Poupkou I and G. Mouzakis 2 ~Laboratory of Atmospheric Physics, Aristotle University of Thessaloniki, 54006- Thessaloniki, Greece 2 Ministry of Environment, Land Use and Public Works, Athens, Greece.
ABSTRACT
Following the SEVESO Directive safety reports have been produced for the major industries in Greece. The reports are being evaluated by the Competent authorities and the appropriate emergency plans are being constructed. In the present work there are presented quantitative and qualitative results from the analysis of the possible accidents from 17 industrial installations in northern Greece. The possible accidents have been grouped and the analysis include the estimated consequences and the zones of influence for different proposed threat limit values. Also a brief description of the methodology followed for the evaluation of the safety reports is presented and discussed.
KEYWORDS
Pool fire, Fireball, Flash fire, UVCE, Dispersion
INDRODUCTION
Since 1988 the Greek legislation is harmonised with the Community Directive 82/501/1982, which is also known as the "Seveso Directive" (Ziomas et al., 1994). Up to present, the involved Public Organisations for the application of the national legislation concerning major accidents are: 1. The Ministry of Industry, Research and Technology (MIRT). 2. The Ministry of Environment, Land Use and Public Works (MELUPW). 3. The Ministry of Labour (ML). 4. The Ministry of Public Order (MPO), where the Fire Corps belong. 5. The Ministry of Health and Providence (MHP). 657
658
I.C. Ziomas et al.
6. The Organisations of Local Governments (OLG) The on-site emergency plan of the installation describes all the procedures and actions to be taken in case of emergency. The aim of the on-site emergency plan is to increase the safety of the installation and to reduce the consequences of any kind, due to possible accidents. Depending on the severity of the accident, on the area affected and of course on the number of people in danger, there are off-site plans of different levels: a) Off-site Emergency Plans at the National Level and b) Off-Site Emergency Plans at the Prefecture Level. In general, the Ministry of Environment, Land Use and Public Works keeps a file of the dangerous chemical substances, draws a catalogue of experts, collects the various reports concerning the accident, gives technical advice and performs pollution measurements. In the framework of the Safety Reports evaluation procedure the Laboratory of Atmospheric Physics, Aristotle University of Thessaloniki, under a contract by the Ministry of Environment, Land Use and Public Works, performed an extended analysis of the possible accidents at 17 industrial installations located in Northem Greece. These installations include LPG and liquid fuel storage, refineries and chemical industries. In the present work there are presented quantitative and qualitative results from the analysis of the possible accidents. The analysis includes the estimated consequences and the zones of influence for different proposed threat limit values.
METHODOLOGY
Categorization of accidents and models used The possible accidents can be grouped in three major categories, based on their consequences. Accidents where flammable and or~explosive substances are involved and therefore the consequences are due to thermal heat flux and blast effects
The phenomena examined for these accidents, depending on the substances involved and the storage conditions, include: 1) pool fire, 2) fireball, 3) jet flame, 4) flash fire and 5) unconfined vapor cloud explosion (UVCE). The methodology followed for the analysis of this type of accidents is mainly based on the research performed by The Netherlands Organisation of Applied Scientific Research (TNO, 1989 and 1992). Since for the same type of accidents different models may be used, a selection was made, after several discussions with the competent authorities and other scientists involved in the evaluation procedure of the safety reports of the various industrial installations in Greece. More specifically: 1) for the pool fires the "source" model was used, which assumes that the fire has a cylindrical shape, 2) for the fireballs the "point" model was selected, 3) for the flash fire the DEGADIS (Spicer et al. 1989) model was used for the calculation of the dispersion of the vapor cloud until the distance where the concentration of the substance reached the lower flammability limit, 4) finally for the UVCE the same procedure as for the flash fire was followed and in case the concentration of the vapor cloud was above the lower flammability limit within the installation then the ignition was assumed to occur at the nearest road. Accidents where toxic substances are released
Depending on the substances involved in the accidental release and their storage conditions two types of models were used: 1) Gaussian models in case that the released plume was neutral or buoyant and 2) the DEGADIS model when the released cloud was initially heavier than air.
Advances in Safety and Reliability: ESREL '97
659
Evaluation of the consequences The Greek competent authorities have not adopted officially any limits concerning the evaluation of consequences from the various accidents. Thus the complete evaluation was not possible and only preliminary conclusions can be drawn. The assumptions applied for the calculation of the thermal and toxic doses were as follows:
Thermal dose For non instantaneous accidents (e.g. pool fire) first the thermal heat flux had been calculated and then the thermal dose for two cases: 1) the observer, 5 s after the beginning of the accident, was moving far from the source of heat with a speed of 4 ms ~ until a distance at which the thermal flux was 1 kwm 2, 2) the observer was in vertical position and standing at the same location for 60 s. For accidents with a duration of a few seconds (e.g. fireball) only the case of standing observer was considered and the thermal dose was calculated for a time equal to the total duration of the phenomenon.
Toxic dose For accidents that involve toxic substances first the spatial distribution of the substances concentrations were calculated and then the toxic dose for standing observer exposed to toxic plume for 30 min. When the toxic substances examined were sulfur dioxide or nitrogen oxides or smoke then the European Union ambient air concentration limits were used.
Blast effects As far as the blast effects were concerned, only the overpressure due to the explosion was calculated at various distances.
RESULTS Two meteorological conditions were considered: 1) atmospheric stability class D and wind speed 5 ms 1 and 2) atmospheric stability class F and wind speed 2 ms ~. For both cases the ambient temperature was assumed 30°C, the relative humidity 50% and the inversion height 300 m. If the maximum duration of the accident was more than 1 hour then the duration of the calculations was limited to 1 hour. Four different typical LPG storage tanks (LPG stored at ambient temperature) were examined, namely: LPG1 (tank volume about 35 m3), LPG2 (tank volume about 200 m3), LPG3 (tank volume about 500 m 3) and LPG4 (tank volume about 2500 m 3 with a 1600 m 2 bund). Concerning the liquid fuel storage facilities a typical floating roof tank was examined (LFST), containing about 60000 m 3 crude oil. Finally two typical ammonia storage tanks were examined, one cryogenic (NH3 (1), 15000 tn of ammonia stored at -33.4 °C) and one pressurized (NH3 (2), 1800 tn of ammonia stored at 0 °C). The results from the analysis of the most significant possible accidents (catastrophic failure) are summarised in Tables 1 to 9. More specifically the results presented in each Table have as follows" In Tables 1-3 the heat flux calculations and the corresponding thermal doses from pool fires are shown. It appears that if a spreading pool is formed (tanks LPG1, LPG2 and LPG3) then the heat flux and the thermal dose at various distances depends on the amount of the liquid stored. It is noted that the consequences from LPG storage tanks are less significant when a bund exists (tank LPG4). This due to the fact that the bund limits the burning surface while, the LPG released on the ground in the absence of a bund forms a spreading pool with considerably larger surface.
660
I.C. Ziomas et al.
In Tables 4 and 5 the heat flux calculations and the corresponding thermal doses from fireballs are shown. It appears that the consequences depend on the mass of LPG which forms the fireball. Blank entries in Tables 4 and 5 are because the corresponding distances are within the fireball. In Table 6 the maximum hazardous distances for a flash fire are shown. The shape of the dispersed plume is usually ellipsoid and the maximum distance corresponds to the largest axis of the ellipse. Since wind direction is not involved in our calculations no estimations are given for the small axis. In Table 7 the distances to specified overpressures are shown. It is noted that the bund in case of tank LPG4 results in smaller evaporation rate and thus less significant concequences. Concerning tanks without a bund (LPG1, LPG2 and LPG3) the calculated overpressures depend on the mass content of the tank. In Tables 8 and 9 the concentration of ammonia and the corresponding toxic dose at various distances are shown. As expected the concequences are far more significant in case of accidental releases from the pressurized tank, since a heavier than air plume is formed.
TABLE 1 HEAT FLUX AT VARIOUS DISTANCES FROM A POOL FIRE
Installation LPG1 LPG2 LPG3 LPG4 LFST
100 5.6 18.1 22.7 7.7 14.1
Heat flux (kwm 2) 200 1.5 6.3 8.7 2.2 4.5
at various distances (m) 300 400 2.9 4.2 1.0 2.1
1.7 2.4
500 1.1 1.5
1.2
TABLE 2 THERMAL DOSE AT VARIOUS DISTANCES FROM A POOL FIRE (STANDING OBSERVER)
Installation LPG1 LPG2 LPG3 LPG4 LFST
100 592 2845 3871 921 2051
Thermal dose ((kwm-2)4/3s) at various distances (m) 200 300 400 107 702 258 122 1072 411 197 177 60 157 73 444
500 67 109
TABLE 3 THERMAL DOSE AT VARIOUS DISTANCES FROM A POOL FIRE (MOVING OBSERVER)
Installation LPG1 LPG2 LPG3 LPG4 LFST
2 4/3 Thermal dose ((kwm-) s) at various distances (m) 100 200 300 400 176 26 1148 356 139 53 1705 593 257 120 296 59 5 752 202 66 14
500 11 52
Advances in Safety and Reliability: ESREL '97
661
TABLE 4 HEAT FLUX AT VARIOUS DISTANCES FROM A FIREBALL
Installation LPG1 LPG2 LPG3 LPG4
Heat flux (kwm "2) at various distances (m) 200 300 400 23.8 11.1 6.4 71.6 36.4 21.6 85.8 50.1 30.2 177 125
100 75.2 154.9
500 4.1 14.2 20.0 89
TABLE 5 THERMAL DOSE AT VARIOUS DISTANCES FROM A FIREBALL
Installation LPG1 LPG2 LPG3 LPG4
100 2883 11810
Thermal dose ((kwm2)4/3s) at various distances (m) 200 300 400 500 622 226 107 60 4223 1718 855 488 7257 3750 1803 1062 28774 17812 11432
TABLE 6 HAZARDOUS DISTANCES FOR A FLASH FIRE Distances (m) Installation LPG1 LPG2 LPG3 LPG4
D5 132 556 857 262
F2 260 2176 3700 536
TABLE 7 DISTANCE TO. SPECIFIED OVERPRESSURES FROM AN UVCE
Installation LPG1 LPG2 LPG3 LPG4
10000(Pa) D5 F2 283 485 580 725 708 907 430 715
Distance (m) 20000(P~ D5 F2 190 330 377 450 429 528 280 471
to specified overpressures
30000(Pa)
50000(Pa)
D5 158 310 336 231
D5 133 255 262 190
F2 278 358 403 390
F2 237 285 302 325
70000(Pa) D5 F2 123 219 233 254 230 258 174 297
662
I.C. Ziomas et al. TABLE 8 CONCENTRATION AT VARIOUS DISTANCES FOR TOXIC SUBSTANCES RELEASES
Substance NH 3 (1) NH3 (2)
Concentration (mgrm 3) at various distances (m) 1000 500 2000 3000 D5 F2 D5 F2 D5 F2 D5 F2 60 500 175 60 26700 1.5 105 6300 11200 1450 788 581
TABLE 9 TOXIC DOSE AT VARIOUS DISTANCES FROM TOXIC SUBSTANCES RELEASES
Substance NH 3 (1) NH 3 (2)
n 2 2
Toxic dose ((mgrm3) nmin) at various distances (m) 1000 2000 3000 500 D5 F2 D5 F2 D5 F2 D5 F2 6 105 5 104 105 6 106 107 1.4 106 1.7 109 1.3 10 ll 1.3 10 s
CONCLUSIONS
It should be noted that all results presented are for worst cases, and would be associated with a low frequency of occurrence. Hence risks may be acceptable if risk-based criteria are used. Since, as already mentioned above, the Greek competent authorities have not adopted officially any limits concerning the evaluation of consequences from the various accidents it is not possible to justify the exact extent of the dangerous zones around the sources of possible accidents. Due to that fact the authors do not intend to draw their own conclusions and thus only rough estimates are presented in the following paragraphs. The reader may reffer to the international literature (eg TNO, 1989) for relating the results of the present work with fatality/injury criteria. For the LPG storage facilities it appears that the possible consequences are: • • • •
for for for for
pool fire the hazardous effects are limited within the area of the installation fireball the hazardous effects are extended outside the installation flash fire the dangerous area is extended outside the installation UVCE the dangerous area is extended outside the installation
It is noted that the consequences from LPG storage tanks are less significant when a bund exists (eg LPG4 in Tables 1-3). This due to the fact that the bund limits the burning or evaporating surface. On the contrary the LPG released on the ground in the absence of a bund forms a spreading pool with considerably larger surface and thus a larger burning area or a larger evaporation rate. For the ammonia storage facilities it appears that the possible consequences are extended far from the installation. As expected the concequences are more significant in case of accidental releases from the pressurized tank, since a heavier than air plume is formed.
Advances in Safety and Reliability: ESREL '97
663
REFERENCES Spicer T. and J. Havens, 1989, "User's guide for the DEGADIS 2.1 Dense Gas Dispersion Model", Cincinnati: U.S. EPA, EPA-450/4-89-019 TNO, 1989, "Methods for the determination of possible damage to people and objects resulting from releases of hazardous materials (Green book)", The Netherlands Organization of Applied Scientific Research. TNO, 1992, "Methods for the calculation of physical effects (Yellow book, 2nd edition)", The Netherlands Organization of Applied Scientific Research. Ziomas I. C., Tzoumaka P. N., Fiorentini C., Romano A., Locatelli M., 1994, "Lessons learned from emergencies after accidents in Greece and Italy involving dangerous chemical substances", Office for Official Publications of the EC, ISBN 92-826-8222-6.
This Page Intentionally Left Blank
B 1O" Industrial Safety
This Page Intentionally Left Blank
USING MODERN DATABASE CONCEPTS TO FACILITATE EXCHANGE OF INFORMATION ON MAJOR ACCIDENTS IN THE EUROPEAN UNION C. Kirchsteiger European Commission, Joint Research Centre, Major Accident Hazards Bureau, TP 670, 21020 Ispra (Va), Italy. e-mail:
[email protected] Tel.: +39 332 78 9391 ; Fax: +39 332 78 9007
ABSTRACT
This paper describes the background, functioning and status of the new version of the Major Accident Reporting System, MARS 3.0, dedicated to collect in a consistent way data on major accidents involving dangerous substances from the Member States of the European Union, to analyse and statistically process them, and to create subsets of all non-confidential data and analysis results for export to all participating Member States. This information exchange and analysis tool is made up.of two connected parts: one for each local unit (i.e., for the Competent Authority of each participating Member State), and one central part for the European Commission. The local as well as the central parts of this information network can serve both as data logging systems and, on different levels of complexity, as data analysis tools. The analysis of events notified to MARS 3.0 is based on two alternative types of approaches: Boolean searches of coded categories of event characteristics (for the local and central units) and hypertext-search based pattern analysis of free text descriptions of event characteristics (for the central unit only). This second option allows the accident causes to be identified and consistently analysed in a much more efficient and objective way, and the succession of the disruptive factors leading to the accident to be identified.
KEYWORDS
risk management, industrial risk, risk regulation, database, accident database, major accidents, industrial accidents, Seveso Directive
IMPLEMENTATION AND TASKS OF THE MAJOR ACCIDENT REPORTING SYSTEM IN THE EUROPEAN UNION
Several initiatives have been taken in many countries around the world to provide industry, governmental and research institutions with high quality information on industrial accidents as a means of accident prevention. Databases containing information on industrial accident events consist of specific sets of data variables describing causes, circumstances, evolution and consequences of past accident events and are designed to meet several objectives, often complementing each other: •
to assist in the formulation of new regulations and safety management 667
668
C. Kirchsteiger principles, to cope with "what-if' requests from the public, industrial management boards and governmental institutions, to assist in risk analysis, as a • qualitative tool, identifying relevant accident scenarios, ° quantitative tool, producing estimates of event frequencies.
Council Directive 82/501/EEC on the Control of Major-Accident Hazards Involving Dangerous Substances ("Seveso I"), European Council (1982), requires the Competent Authorities (CAs) of the (currently) 15 Member States of the European Union to notify all (non-nuclear, non-military, non-mining, non-transport related) major accidents involving dangerous substances which occurred in their respective countries to the European Commission. For this purpose, the Commission has set up in 1984 an industrial accident notification scheme, the Major Accident Reporting _S_ystem(MARS), operated and maintained by the Major Accident Hazards Bureau (MAHB) of the Commission's Joint Research Centre in Ispra / Italy. Besides the Member States, other European countries outside the European Union, such as Norway or some of the Eastern European countries, are already participating in MARS on a voluntary basis or have indicated their interest to do so. The accidents reported are collected in a register and information system ("MARS database"), and analysed in order to: classify the accidents according to various parameters, in particular the type of industrial activity, substances involved, consequences, and causative factors, extract the lessons-learned from the accidents to prevent the recurrence of similar accidents and to mitigate the consequences of accidents which do occur. The system currently holds information on about 280 accidents and incidents, information which has been submitted on a hardcopy (paper) basis in either English or in one of the other 10 official languages to the Commission in confidence for the use of the Commission and the National Authorities of the Member States. MAHB staff translate, if necessary, the forms submitted into English (the working language of MARS), check the consistency of the information, confirm any unclear, missing or inconsistent points with the national CA concerned, and input it into the computerised MARS database system. The number of events reported so far is - fortunately - not very large, but what makes this database unusual among industrial accident databases is the level of detail, which is usually sufficient to establish the detailed causes of the accident, both the intermediate causes and the underlying ones. Parts of the information submitted to MARS is considered confidential if it calls into question, for example, the confidentiality of the deliberations of the CAs and the Commission, public security, personal data and/or files, commercial and industrial secrets, etc. However, without violating these aspects, access to the register and information system has always been open to government departments of the Member States, industry, non-governmental organisations and research organisations working in this field.
STRUCTURE AND USAGE OF INFORMATION INCLUDED IN MARS Information on the major accidents to be notified to MARS consists of both character and numeric types of data in free text as well as in selection list type of format on events and circumstat~ces leading to the major accident, descriptions of the evolution of the accident, consequences (impact on humans, material loss, ecological harm .... ), emergency responses and lessons-learned. To ensure basic consistency in the understanding of the characteristics of an accident event to be notified, the CAs in the Member States have to put these data into a special agreed-upon format, the so-called "Accident Notification Form". As a result of an iterative process, two such MARS reporting forms have been established: the "short report" is intended for use for immediate notification of an accident, and the "full report" is prepared when the
Advances in Safety and Reliability: ESREL '97
669
accident has been fully investigated, and the causes, the evolution of the accident, and the consequences are fully understood. In certain cases further information comes to light - for example in the course of judicial proceedings - and there is provision for the "full report" information to be further modified. The "short report" gives essential information conceming the accident, in a selection list and associated freetext format, under the following 7 headings (data variables): • • • • • • •
accident types, substances directly involved, immediate sources of accident, suspected causes, immediate effects, emergency measures taken, immediate lessons-leamed.
The "full report" is much more analytic, and involves more work in its preparation. To provide the possibility of using as many original information as possible (and to validate the considerably subjective assignment of codes from selection lists), there are always sufficient free-text fields available in this form to describe facts connected with an accident. Using the information included in "full reports", the MARS database can be searched under almost 200 different headings (data variables), e.g.: type of accident (~25 coded subtypes for the 5 "short report" types) in terms of." • major occurrence, • initiating event, • associated event, dangerous substances (>200 named substances from Seveso I / II or CAS number, uses of substances in plant, estimates of quantities): • total establishment inventory, • relevant inventory (in)directly involved, source of accident: • type of industry where accident occurred (~20 coded subtypes), • type of activity being carried out (~15 coded subtypes), • systems / components directly involved (~ 15 coded subtypes), causative factors (immediate and underlying: ~35 coded subtypes), number of people affected (fatalities, injuries, people at risk), ecological harm (~20 coded subtypes), national heritage loss, material loss, disruption of community life, emergency measures taken / still required / continuous contamination or danger (~30 coded subtypes), accident response: • pre- / post-accident evaluation, • evaluation of safety organisation, • evaluation of ecological impact control, official actions taken, lessons-learned,
Using this information, regular summaries of accidents notified are prepared for the Committee of "Seveso Directive" CAs as well as occasional specific studies of lessons-learned from accidents, both for the Committee and - with identifying details removed - for the general public. Since the software structure of the previous database system, MARS 2.0, did not allow hypertext retrieval, besides Boolean searches of coded database categories, lessons-learned type of data analyses to identify overall patterns in the accidents
670
C. Kirchsteiger
data could be performed on a largely manual basis only. Along with corresponding studies and presentations at the periodic meetings of the Committee of CAs, several open publications have been performed in the last years on lessons-learned type of analyses of the non-confidential part of the data, see e.g. Drogaris (1993), Rasmussen (1996), Papadakis et al (1996). In addition to that, specific requests are continuously received by MAHB from external institutions to perform topical analyses on non-confidential MARS data (e.g., related to circumstances of accidents in fuel storages and underground storages, oil pollution accidents and incidents, vapour cloud explosions, etc.).
NEW I N F O R M A T I O N EXCHANGE SYSTEM (MARS 3.0) The accidents included in MARS are so-called "major accidents", as defined in general terms by the original text of the Directive, European Council (1982), and in a later amendment, European Commission (1988), without giving quantitative threshold criteria on, for example, the event consequences. Therefore, since until recently (i.e., on the basis of "Seveso I") only general guidance has been available as to what constitutes a "major accident", it has to be assumed that the different interpretations of this term have led to slightly different practices in notifying accidents. Yet, however fuzzy the concept of a "major industrial accident" may have been in the past, it seems to be that there has always been a general understanding that all these events have as basic common feature at least the potential to affect many people. The Commission has recently published a new Directive, "Seveso H", European Council (1997), replacing and strengthening the original Directive. Significant MARS related changes are implied by "Seveso II", in particular concerning criteria for the notification of an accident to the Commission, information system and exchanges, confidentiality of information submitted. Besides giving a clear and unequivocal definition of what constitutes a "major accident", resulting in an overall lowering of the threshold criteria for the notification of an accident to the Commission and thus in an increased number of events to be reported, the new Directive calls for a more open approach to the supply of information to the public, both from the Member States and from the Commission, supported by a precise definition of which type of information has to be kept confidential to interested parties other than the Committee of "Seveso Directive" CAs (see above Section 1). The number and contents of MARS data variables as summarised in the "Accident Notification Form" is, however, not subject to changes. In the light of the new requirements and the presumably significant increase in event notifications, the software structure of MARS had to be completely changed and consists now in its Version 3.0 of a distributed self-standing data logging system and analysis tool running on a MS-Windows © platform ("local DOS-MARS"), supported by a centralised DOS and UNIX data management system ("central DOSMARS", "central UNIX-MARS"), which reaches the required efficiency with the help of a UNIX-based relational database management system. This concept ensures the management of large and complex data sets, consisting of data of several different object classes. Due to the significantly larger number of events to be included in MARS 3.0, a manual evaluation of the free text elements of accident case histories to formulate lessons-learned type of results is no longer possible. Database evaluation based on Boolean analysis of event codes only bears, however, the risk of dependence on often subjective code assignments, which - especially in the case of identification of the underlying accident causes - can never be complel~ely eliminated. Therefore, to assure a high rate of automatic capturing of relevant information, a new method based on the indexing of relevant free text elements had to be developed for the central UNIX-based part of MARS 3.0. Each "non-trivial" element in each free text field of each MARS event is inserted into a general MARS thesaurus, from which specific user-defined sub-thesauri can be created. A sub-thesaurus can be topic-specific, e.g. related to human errors,
Advances in Safety and Reliability: ESREL '97
671
and consists of strings of expressions connected by their similarity. On this basis, complex queries, such as user-defined cluster and pattem analysis, are possible. Another important element in the functioning of MARS 3.0 is the new way of exchanging information between local units and the central database. By using their local MARS 3.0 unit, the CAs of the Member States can create under a user-friendly windows-guided environment their accident data files in ASCIIformat by writing accident descriptions in the English language and assigning codes (see Section 2). Before saving such a file, all data are automatically checked by the system for consistency and completeness of information. Consistency is assured by a variety of logical tests across the data variables, completeness is assured by defining all short report and a large number of full report data variables as being obligatory (blank input in such fields prevents saving of files). Accident event files are then sent by the CAs on 3,5" diskettes or via e-mail to MAHB, which reads them into its central DOS-part of MARS 3.0 for qualitycheck and, if necessary, for further editing in accordance with the respective CA. Next, the agreed-upon "final version" of an event data file is exported to the central UNIX-part and included in the total population of MARS events. Both the central and local units include options to perform statistical evaluations and to generate corresponding reports which can further be edited by using standard word-processor tools in a MSWindows ® environment. For more detailed analyses, extracting lessons-learned from accidents reported, MAHB can perform on its UNIX-part of MARS 3.0 cluster and pattern analyses on the entire data set. To support building local MARS databases in each Member State, MAHB makes periodical copies of data subsets from its central UNIX-part and distributes them to each participating CA. Each such subset consists of all CA-specific data as well as all non-confidential data of all other CAs. Further, MARS data analysis results will periodically be distributed to the CAs in an electronic format for further processing. The basic functioning of this information exchange system is depicted in the following Figure 1:
Ba sic
oj
,3°o
M
MAHB (UNIX)
A -r-rY~
(r v
....~iiii
%i~i,i'iiipi~ii,'~,iii,'ii.i~..ii~
,,..._.-----
Figure 1" Basic Structure of the New Information Exchange System MARS 3.0
672
C. Kirchsteiger
STATUS AND O U T L O O K ON THE FUTURE USE OF MARS 3.0 From May to October 1996, the detailed software specification and design of MARS 3.0 have been defined and discussed with various international bodies, including all CAs, resulting in the network-type of database structure outlined above (DOS-part for the CAs, DOS/UNIX-part for MAHB). Having finished the actual software development and testing in early 1997, the entire database contents of MARS 2.0 have been transferred to the new system. Following that, a workshop on the practical use of MARS 3.0 has been organised by MAHB in Ispra for those CAs with an active short-term interest in the use of the new system for the purposes of exchanging and discussing information, experiences and analysis results on major accidents with the Commission. As of January 1997, 13 of 15 CAs of the Member States of the European Union have declared such a short-term interest in MARS 3.0 and thus received from MAHB their copy of the local DOS-part of the system. Although there is an overall legal obligation to notify information on major accidents to the Commission, neither the "Seveso I" nor the "Seveso II" Directive give - for good reasons - a detailed technical specification how this should actually be accomplished. Therefore, Member States can in principle continue to send hardcopy reports on major accident occurrences in one of the 10 official languages of the European Union other than the English language to the Commission. However, many real benefits are related to a usage of the new system by the CAs: CAs can easily create and edit their MARS relevant accident events in MARS-consistent format, CAs can easily send the resulting electronic data files in standard ASCII-format to MAHB (on diskettes, via e-mail), CAs receive from MAHB periodic electronic updates of the contents of MAHB's central UNIX-based MARS database (i.e., all their own and all nonconfidential data from all other CAs), CAs can thus build up their own local accidents database in MARS-format, CAs can make statistical evaluations of their accidents data and generate corresponding reports. In accordance with the Seveso II requirements of a more open access to all non-confidential information, possible participants in the MARS 3.0 information exchange system are not only the CAs of the Member States and the European Commission, but also all other interested parties in the area, such as "industry or trade associations, trade unions, non-governmental organisations in the field of the protection of the environment and other international or research organisations working in the field", European Council (1997). The long term goal of MARS 3.0 is to develop an information network that provides electronic access to all major industrial accidents knowledge and experience within the European Union to anyone (in different levels of detail, depending on the aspect of confidentiality of raw data), anytime, anywhere. Any such network is bound by successful communication, which is a precursor to more sophisticated structures and purposes of a system. For MARS, this purpose is improved policies and practices on industrial accidents prevention, mitigation and response through successful international co-operation and information exchange. Further, as the information society develops and expands, it can be expected that in the next few years more and more demands for "instantaneous" on-line access to MARS data and analysis results are asked for (e.g., via the WWW). Although, from a technical point of view, MARS could be put on the Internet in the very near future, a complete integration of the MARS database in the WWW does not seem to be desirable at this moment, mainly due to reasons of data security.
Advances in Safety and Reliability: ESREL '97
673
ACKNOWLEDGEMENTS The valuable discussions with colleagues from the Major Accident Hazards Bureau in Ispra, Directorate General XI/E.1 in Brussels and the National Authorities in the Member States, their comments and assistance in defining and implementing MARS 3.0 are gratefully acknowledged.
REFERENCES
European Council (1982). Council Directive 82/501/EEC on the Major Accident Hazards of Certain Industrial Activities ("Seveso I"). Official Journal of the European Communities. Drogaris, G. (1993). Major accident reporting system : lessons learned from accidents notified, Elsevier Science Publishers, Amsterdam, The Netherlands. Drogaris, G. (1993). Learning from Major Accidents Involving Dangerous Substances. Safety Science 16, 89-113. Rasmussen, K. (1996). The Experience with the Major Accident Reporting System from 1984 to 1993, European Commission, Joint Research Centre, EUR 16341 EN. Papadakis, G., Amendola, A. (1996). in: Probabilistic Safety Assessment and Management '96, Springer Verlag, Berlin, Germany, 101-106. European Commission (1988). Report on the Application in the Member States of Directive 82/501/EEC of 24 June 1982 on the Major Accident Hazards of Certain Industrial Activities. COM(88) 261. European Council (1997). Council Directive 96/82/EC on the Major Accident Hazards of Certain Industrial Activities ("Seveso II"). Official Journal of the European Communities.
This Page Intentionally Left Blank
PLANT SAFETY IMPROVEMENT BY LOGICAL - PHYSICAL SIMULATION
N. Piccinini °, C. Fiorentini ^, L. Scataglini*, and F. De Vecchi ^ ° Politecnico di Torino (C.so Duca degli Abruzzi, 24 - I 10100 Torino Italy) * Agip SpA (Via Emilia, 1 - 1 20095 San Donato Milanese - MI Italy) ^ TECSA SpA (Via Oratorio, 7 - 1 20016 Pero - MI Italy)
ABSTRACT
This paper describes the way Integrated Dynamic Decision Analysis (IDDA) can be used to represent the ordinary, reduced and incidental states of a plant and all its irregular operating conditions, and determine their occurrence patterns (event analysis). The description is related to a real case of a natural gas drying plant. The versatility of the analysis program was exploited to simulate several plant improvements designed to minimize the risk of the plant being shut down through the spurious intervention of its protection systems.
KEYWORDS
Decision Analysis, Probability, Event Analysis, Optimization, Phenomenological Analysis, Integrated Analysis, Protection systems
INTRODUCTION This paper describes how it was possible to modify and reoptimise the protection systems of a natural gas drying plant so as to prevent their spurious intervention and the consequent discharge of large quantities of gas into the atmosphere. The probability of such events must be kept below 10-6 according to the indications supplied by the Owner of the plant. The study was conducted with a computerized methodology known as integrated dynamic decision analysis (IDDA). It is based on logical and probabilistic techniques using the decision analysis tree for modeling, and is the latest product of a research line developed solely by R. Galvagni over the course of many years [ 1-5]. As a Decision Analysis IDDA is based on a rigorous application of Logic to define and to depict all the possible alternative incompatible scenarios among witch the choice has to be done. Each alternative scenario is developed and presented according to a cause-consequence logic approach. In this approach both logic rules and probability evaluations are applied dynamically in that each piece of information progressively received can be used to define the successive logic path ant the conditional probabilities of the following events. But besides being Dynamic a Decision Analysis tool must also be Integrated with the physical behavior of the phenomena that the logical event trajectory implies. In order to be effective, a scenario in 675
676
N. Piccinini et al.
form of a logical trajectory has to represent both its logic-probabilistic and its physic-phenomenological evolutions. Further, knowledge of the phenomenology supplies directly the consequence related to each alternative scenario giving, along with the probability supplied by the logic-probabilistic elaboration, a unique overall representation; that is the information necessary to define that basic parameter of decision giving by "Risk", when evaluated on every possible foreseen alternative. IDDA was applied to a natural gas drying plant that is likely to release large quantities of gas into the atmosphere in the event of the unavailability of the downstream distribution network. This eventuality can also lead to pressure transients in excess of the design values of the drying columns and hence likely to damage them [6-7]. Greater gas consumption in recent years has led to the employment of plants in increasingly critical conditions. In other words, the intervention values of a plant's protection systems may be extremely close to those in which it normally operates, and spurious shutdowns are becoming increasingly frequent.
THE PLANT The plant referred to in this paper is located downstream from an exhausted natural gas field now employed as a backup lung to meet heavy consumption demands during the winter. In summer, in fact, when consumption is well below the average, gas is piped off from the distribution network and stored in the field. In winter, this gas is returned to the network. Before this can be done, however, it requires thorough drying. The layout of the drying plant is illustrated in fig.1. An intake manifold receives four input lines 1-4, each with a shutdown valve (SDV 75-78). Lines 1-4 join each other before the shutdown valve SDV 79. The gas is taken from the manifold to two parts of the plant. The first branches into four lines, the second into three, each with a drying column. The maximum design pressures of the first four columns are 72.5 barg (D l-D2) and 74.5 barg (D3-D4). They can all handle 3.5 • 106 Nm3/d of gas, the second three (D5-D7) have a maximum design pressure of 78.5 barg and can handle 4.5 • 106 Nm3/d of gas. Upstream from each column there is a shutdown valve (SDV 80-86) and a pressure control valve (PCV 61-67), each governed by a control system (PSH 1-7 and PIC 10-16) installed on the respective columns. Downstream from the columns, each line has another flow control valve (FCV 68-74) actuated by a pressure indicator controller (PIC 9) mounted on the collection manifold. Downstream from these regulating valves, the two parts of the plant meet up on a single output manifold with a shutdown valve (SDV 87). This line is also fitted with a high-pressure switch (PSH 8) that actuates all the plant's shutdown valves. Damage to the columns caused by excessive pressure is avoided by the installation on each upstream line of a one-way valve followed by a blow-down. The four lines from columns D l-D4 meet on the first blowdown manifold and the three from columns D5-D7 on the second. Each manifold is fitted with 4 PSV calibrated at 72.3 barg and at 78.5 barg on the first and second. The PSVs can discharge all the flow routed to the plant. The maximum design flow rate for the first manifold is 8.88.106 Nm3/d, and that for the second is 12.72-106 Nm3/d, while that of the discharge to the atmosphere is 15.106 Nm3/d, so that the Mach number is less than 1.
EVENT ANALYSIS The plant is thus composed of 77 components (61 valves, 8 high-pressure switches and 8 pressure regulators) capable of causing excess pressures, and 277 (1.5 • 1023) system states are possible. IDDA taken to scenarios with probabilities low enough not to exclude events of interest (a value of 10.9 was chosen in the light of previous experiments) showed that the number of alternatives was still beyond the handling capacity of the program [6-7]. It can be seen from the description of the plant that its configuration does not allow any reduction in the
Advances in Safety and Reliability: ESREL '97
677
number of alternatives through the use of symmetries. This reduction was therefore obtained by successive steps. A check was made at each step to ensure that the assumptions and eliminations would not have a significant effect on the dynamic response of the system (pressure and flow rate transients). A peculiarity of IDDA, in fact, is that it associates physical models with each operating alternative generated. In the present case, in addition to supplying the occurrence probability it traces the pressure and flow rate transient diagrams for each section of the plant. The phenomenological model takes account of the: • volumes in each part of the plant • flow rates and volumes during regular operation • load losses in the pipes • regulating and shutdown valve intervention times and characteristics • safety valve opening and reclosing characteristics • protection device intervention thresholds.
Step I - Identification of the initiating events Examination of the plant shows that five events could cause a pressure transient capable of leading to a flare off, namely: 1. Spurious closure of downstream shutdown valve SDV 87 (closing time 28s) 2. Spurious closure of downstream valve SDV 88. As a conservative estimate, it is assumed that this valve closes in 4 s so as to take all the possible high pressure to the consumer abnormalities into account. 3. Spurious closure of one of the FCVs downstream from the drying columns. Calculations have been made for FCV 68 (columns D1 3.5 mNm3/g) and FCV 72 (column D5 4.5 Nm3/g) (closing time: 10 s). Spurious operation of PSH 8 resulting in closure of the SDVs, including downstream SDV 87. The transmitter on the intake manifold under-reads the real operating pressure. This transmitter acts on both the central input and the output regulating valves. A spurious intervention of this kind leads to the closure (75% maximum) of the valve upstream from the columns and makes it impossible for those downstream from the separators to close. In view of the very fast reactions of the plant to each of these causes of excessive pressure, it is unreasonable to suppose that several events could overlap. Attention has thus been directed to the possibility that one or several parts of the protection system fail to intervene following a single initiating event.
Step H - Reduction of the number of alternatives by event analysis
Central input lines (clusters) The plant receives four clusters of eight lines, each with its pressure regulating valve closed by the pressure indicator controller (PIC 9) on the manifold (fig.l). These 32 valves may work correctly or fail, giving 232 = 4.3 • 109 operation alternatives. Since the flows from the clusters are not all the same, there are no identical operating situations. The phenomenological method, however, demonstrates that the failure of one valve to close rather than another does not result in any significant differences in the pressure peaks in the column and the blow-off peaks. An evaluation was therefore made of the probability that "k" out of the "n" valves present would not regulate by analyzing separately clusters A and clusters B/C/D as a whole. It was found that this probability was 5.5 10 .8 for 10 of the 24 valves on B/C.D. The probability of all the time trajectories that would result in the failure of more than 10 valves was added to this probability to give that for the failure to close of 10 or more
N. Piccinini et al.
678
valves. A similar procedure was used for cluster A. Here there were 7 mutually excluding alternatives. The total number of alternatives was therefore 170 instead of the initial 4.3.109.
A BLOWDOWNt A BLOWDOWN,t
I
I
I
" L
©
CLUSTERB ~
© ~3j,
CLUSTERC
2j
1)
~
~.~
6
' 7
T Fig. 1 Plant layout
Drying columns Columns D l-D2, D3-D4 and D5-D7 were analyzed separately. Examination of the transients showed that excessive pressure values are never reached in D3-D4 because their maximum design pressure is 74.5 barg and the PSVs come into operation at 72.5 barg If the protection system fails to intervene, the operating conditions are such that the maximum design pressures of both D1-D2 and D5-D7 are exceeded. The behavior patterns and consequences are much the same in each case. An assessment has therefore been made of the probability that one or more columns of each set remain open. The transients also showed that because of the extremely long response time of the shutdown system it is enough for the regulation system to be inoperative to have a pressure peak in excess of the maximum design value. For this reason, the probability that one or more columns in each set do not regulate has also been calculated.
TABLE 1 PROBABILITY THAT ONE OR MORE COLUMNS REMAIN OPEN
Columns
D l-D2
D5-D7
PSH 8
Lines open
1 2
operating 9.50.10 l 3.88 • 10 .5 1.74 • 10 1°
faulty 4 . 8 9 . 1 0 .2 2.76 • 10 -4 3.88 • 10 .7
0 1 2
9.50 • 10 1 5.83 • 10 .5 4.27" 10 ~°
4.88 • 10 2 4.13 • 10 4 1.16" 10 -6 1.02" 10 -9
3
Advances in Safety and Reliability: ESREL '97
679
III step - Reduction of the number of alternatives by analysis of the initiating events (transients) The results of the separate analysis of each of the initiating events described in 3.1 are set out below.
1. Spurious closure of the central output shutdown valve (SDV 87) It was found that both column excess pressure and flare-off pressure transients can occur. In the case of D1-D2, the simple failure of the regulation system to operate results in excessive column pressure, whereas in that of D5-D7 this will only take place if they remain open. The number of input cluster regulation valves that fail to close has no significant effect as far as the generation of excessive pressure is concerned. As to the flow discharged to the blow-down manifolds or the flare off, the maximum design pressure values are only exceeded in the event of PIC9 and PSH8 failing to intervene at the same time.
2. High pressure to the consumer. What been said with regard to the previous event is equally applicable.
3. Spurious closure of a FCV downstream from the drying columns As in the preceding cases, analysis of the transients shows that no major problems arise with regard to the flow flared off or discharged to the blow-down manifolds, whereas the non-operation of one or more regulation valves results in a rise in pressure above the maximum design value.
4. Spurious operation of high-pressure switch PSH 8 The reaction times of the system are such that in this event the delivery of gas to the central plant is stopped a few seconds after the closure of SDV 87. Problems are thus confined to the case in which one of the columns D l-D2 remains open, since here the intervention of their SDVs has proved sufficient. The discharge from the flare is limited. If more than one column stays open, the excess pressure is distributed and does not rise above the set values of the PSVs. Its contribution to the overall risk is negligible.
5. Spurious operation of PIC 9 No problems arise with respect to the flow flared off or discharged to the blow-down manifolds, whereas non-operation of the regulation system of D1-D2 causes an increase in pressure toabove the maximum design value. Excessive pressure in D5-D7, on the other hand, will only occur if one line remains open. The number of possible alternatives for each initiating event is 288 (leading to excessive pressure) and 167 (leading to flare off) for initiating event 1 and 2; 15 for initiating event 3 and 570 for initiating event 5. A probability rating of 10.9 has been considered.
Step I V - Estimation of the probabilities of occurrence Table 2 expresses the consequences of each initiating event as the probability that the following variables will rise above their preset threshold values: • flow of gas delivered to the manifolds or flared off • pressure reached inside the drying columns • gas discharge Mach number.
680
N. Piccinini et al. TABLE 2 PROBABILITY OF EXCEEDING THE DESIGN VALUES (SUMMARY)
Initiating event
P column D1/D2 > 72.5 barg
P column D3/D4 > 74.5 barg
P column D5/D7 > 78.5 barg
1 2 3 4 5
3.56 • 10.3 1 . 1 0 . 1 0 -3 9.60" 10-3 3.70 • 10- 6 2.50 • 10.3
-
5.16 • 10.3 1 . 5 9 . 1 0 -3 1.44" 10 -2
TOTAL
-
-
-
1.91 • 10.4
3.81 • 10.2
Q
Q
manifold 10">8.88 M N m 3/g < 101° 12.72 M N m 3/g < 101° < 101° < 101° < 10l° < 101°
< 10 1°
Q flare off >15 M N m 3/g < < < <
72.5 barg
Column Pressure D5/D7 > 78.5 barg
Operating
1.08 • 10 .8
2.44 • 10 .9
1.32 • 10 .8
Fail
1.88 • 10 s
2.9 • 10 .7
3.08 • 10 -7
3.32 •10 .8
4.89 •10 -s
8.22 •10 -8
f
TOTAL
The effects of these various changes are summarized in Table 5. As can be seen, the probability of there being a discharge to the manifolds and/or the flare is below the threshold defined by the Owner of the plant, whereas the probability of excessive column pressure is of the same order of magnitude. Event 2 (high pressure to the consumer) provides the major contribution to this eventuality: its probability of occurrence has been assumed as 10 -2. A more precise definition of this value, or the adoption of operating, management and safety procedures agreed with consumers, should bring this parameter, too, within the limits laid down.
TABLE 5 PROBABILITY OF EXCEEDING THE DESIGN VALUES (SUMMARY)
Initiating event 1
2
Pressure > design values pressure 3 . 2 1 . 1 0 .7 6.22 " 10 -6
3/4 5
8.22 • 10 .8
TOTAL
6.62 • 10 .6
682
N. Piccinini et al.
CONCLUSIONS This study was conducted by combining the probabilistic logic approach with physical simulation of the operating parameters (flow rate and pressure). Its results demonstrate that: - the probability of a flare discharge is rather high (3.8" 10-2) in the original setting - the problems raised by discharge to the blow-down manifolds or the flare are rather limited. The need to install new columns or alter their maximum pressure values has been avoided by simply adopting the following measures: a. reduction of the SDV intervention and closing times (use of an electric instead of a pneumatic signal) b. increase of the wellhead valve pressures to about 70 barg c. reduction of the set point for PSH 8 on the output manifold at 72 barg d. reduction of the set point for PIC 9 on the intake manifold at 71 barg e. installation on the central output valve of a limit switch signal activating the shutdown system f. installation of a second pressure transmitter linked to PIC 9 so that both would need to operate (spuriously) in order to close the central regulating valves. With these modifications, the probability of excessive pressure in the columns is 6.62 • 10-6. This value can be regarded as acceptable, since the probability of discharge to the flare or the blow-down manifolds with a flow rate exceeding the design values is less than 10 -10. This application has shown that once a value regarded as acceptable because it embraces the complete set of alternatives becomes available operating decisions can be taken to improve the safety of the plant. Furthermore, this result has been reached at very little expense.
REFERENCES (1) Felicetti F., Galvagni R., and Zappellini G., "Analisi di sicurezza- Metodologia Semiprobabilistica e suo Sviluppo Applicativo", CNEN-RT/DISP, No. 78, 10, 1978. (2) Galvagni R., and Clementel S., "Risk Analysis as an Instrument of Design" in "Safety Design Criteria for Industrial Plants". M. Cumo and A. Naviglio (eds.), CRC Press, Boca Ratom, 1989. (3) Senni S., Semenza M.G., Galvagni R., "A.D.M.I.R.A. - An Analytical Dynamic Methodology for Integrated Risk Assessment" Int. Conf. Probabilistic Safety Assessment and Management, Feb. 4-7, 1991, Beverly Hills, G. Apostolakis (ed.), Elsevier, 20, 303-321, 1988. (4) E. Antona, I. Fragola and R. Galvagni, "Risk based decision analysis in design" 4th Conference SRA Europe, Rome, October 18-20, 1993 (5) R. Galvagni, I. Ciarambino and N Piccinini, "Malfunctioning evaluation of pressure regulating installation by Integrated Dynamic Decision Analysis", Int. Conf. PSAM II, San Diego, March 20-25, 1994. (6) R. Galvagni, I. Ciarambino, C. Fiorentini and N. Piccinini, "Integrated risk analysis of natural gas drying plant", 2nd Conf. on Chemical Process Engineering, Firenze, May 15-17, 1995 (7) N. Piccinini, I. Ciarambino, L. Scataglini, C. Fiorentini, S. Atallah, "Application of Integrated Dynamic Decision Analysis (IDDA) to a gas treatment facility, Chemputers IV Conference and Exposition, Houston, Texas march 11-13, 1996
PLANNING OF COMPONENT INSPECTION: DEVELOPMENTS IN THE NETHERLANDS J.H. Heerings 1 and J. Boogaard 2 i Project Office for Research on Materials and Production Technology, Apeldoorn, NL 2 Group Mechanical Plant Services, DSM Services, Engineering Stamicarbon, Chairman of the Dutch Quality Surveillance and Non-Destructive Testing Society, Geleen, NL
ABSTRACT In The Netherlands the inspection intervals for pressurized equipment are defined in the so-called Stoomwezen Rules which are compulsory by law. The prescribed intervals are fixed and more or less dependent on the type of equipment. In order to create more flexibility in inspection planning, recently a group sponsored project was undertaken. This was aimed at the development of a methodology for strategic planning of component inspection in the process industry. Checkable criteria have been formulated with regard to the conditions under which extension of the currentlyprescribed intervals can be considered justifiable. The methodology is based on the concept of'risk based inspection', including both the 'probability of failure' and the 'consequence of failure'. Besides the methodology has been tuned with the existing Dutch regulations. Therefore the new methodology is considered not to be a replacement of the existing Rules but rather an addition, which enhances the implementation. This year a validation programme will run to gain wide acceptance and to achieve implementation of the 'risk based inspection' concept in the Dutch regulations.
KEYWORDS
Inspection planning, Risk based inspection, Process industry, Pressure vessels, Extension inspection interval, Consequence of failure, Probability of failure, Organizational manageability
INTRODUCTION
By long tradition periodic inspections have been used by the process industry as a means of ensuring the continued safety and reliability of equipment and structures. They are prescribed by the government as legislative authority (e.g. within the scope of the Pressure Vessel Inspectorate or of environmental regulations) or they have been initiated by companies themselves. In particular the intervals at which the prescribed inspection must be carried out have at times been felt to be 'too rigid' and an obstacle to efficient production. In the process industry over the years there have been considerable changes in the operation of process installations: 683
684
J.H. Heerings and J. Boogaard - the processes have become more controllable because more experience has been gained and/or because improved process monitoring equipment has become available. There is less load on the integrity of the equipment. - more experience is available regarding the nature and the expected growth of damage phenomena that may occur in structures and equipment during operation and the manner in which appropriate maintenance work can help to avoid such. - new and improved inspection techniques have become available. - Quality Assurance systems in accordance with 'ISO 9000' are leading to a more structured and thus better control of operation and improved maintenance. Production and maintenance are becoming more and more integrated and there is a powerful drive towards optimizing the overall operating costs (sometimes right from the start of the planning phase). During this optimization drive the necessity for traditional inspections and the fixed inspection intervals, among other factors, has been critically evaluated. This has already resulted in some relaxation of the rigidity of intervals concerned such as are set out in the "Rules for Pressure Vessels" [1] (abbreviated to RToD in Dutch) following the recently-created possibility of "stretching", under stringent conditions, the interval for individual items of equipment. This possibility is formulated in Appendix 1 of Sheet T0102 from the RToD and shall be referred to as 'T0102' in this paper. There is, however, a conviction, shared by both industry and the supervising bodies, that a system for further relaxation of inspection intervals must be possible, but the question still remaining is, how can this be done while retaining a "guarantee" that safety will remain undiminished.
In order to develop this idea the project "Condition monitoring of process equipment" [2] has been carried out in collaboration with the Dutch process industry and the government under the leadership of the TNO Metals Institute. This resulted in the setting up of a methodology, with which the permissibility of proposed inspection intervals can be judged. The methodology is in the first place aimed at equipment that must satisfy the "Rules for Pressure Vessels". In the next few months the methodology will be validated in practice so that wide acceptance should be possible.
NEWLY DEVELOPED M E T H O D O L O G Y In drawing up an inspection programme for a given installation the nature and extent of the inspection activities and their frequency must first be defined. In the current methodology the laying down of the inspection intervals is the central consideration, and the nature and extent are regarded as dependent variables. Since the sheet T0102 (from the Dutch Rules for Pressure Vessels) defines fixed intervals for inspection, the term 'interval extension' or 'flexibilizing inspection' is often used. Following this line of thought the systematics of judgement has been drawn up to allow the inspection interval in a given situation to be determined. In determining the possible inspection interval a distinction is made from three inspection regimes, viz. * regime 1: no extension of interval allowed * regime 2: interval extension allowed up to the maximum of T0102 * regime 3: interval extension allowed beyond the maximum of T0102 Which regime is to be * determination of the * determination of the * determination of the
applied to a given situation is determined on the basis of three factors, viz. hazard class technical control organizational manageability
Advances in Safety and Reliability: ESREL '97
685
The combination of the second and third factor determines in fact the total manageability and thus represents a definite probability of failure. Therefore the three factors together represent both the 'consequence of failure' and the 'probability of failure'. In LIK and US literature the term 'risk' is commonly used to express the combination of'consequence of failure' and 'probability of failure'. So the newly developed methodology is in line with the international trend to use the concept of 'risk based inspection', see figure 1.
Hazard class
Technical control
Organizational manageability
Figure l: The basic elements of risk based inspection This trend is clearly illustrated by the risk based inspection methodology which has recently been developed by DNV under auspices of the American Petroleum Institute (API) [3,4]. Besides various process industries have developed company specific methodologies, which are mostly based on both the elements 'consequence' and 'probability'. However, two main groups can be distinguished: some of the 'risk based methodologies' are based on the use of a statistical figure to express the probability of failure whereas other methodologies use the estimated (residual) lifetime as basis. The methodology presented in this paper belongs to the second category and is therefore based on determination of the residual lifetime of the equipment concerned. This choice is made because of the intended purpose of the methodology, that is to derive inspection intervals in absolute terms. The use of statistical data is considered more appropriate in case of comparative studies, for instance when priorities in inspection should be set. In the newly developed methodology two subsequent steps should be made to conclude on the inspection interval: firstly the so-called 'inspection regime' is defined and secondly the inspection interval is derived. The 'inspection regime' is defined by the diagrams in figure 2. Once an installation has been classified in a given hazard class (1, 2 or 3) the defined diagram then applies to that category. Rating of the organizational manageability is carried out once every three years and is identical for all the installations of one company or site. The technical control is established for individual installations or parts thereof.
686
J.H. Heerings and J. Boogaard Hazard Class 1
Technical control
Regime 3: Beyond T0102
great
reasonable
little
................................................................................................................................................ i iiii~i~i~i ........................................................................................... i................................................ ii......
Regime 1 No extension standard
good
advanced
Organizational manageability
Hazard Class 2
Technical control
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ........................................................... great
........................................................... :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -.:::.::: ...................................................... = ~:~:~ .......................................................................................................... =.:::.::: ...................................................... ~i!ii~!iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiill ...........................................................
Regime 3:
Beyond T0102
~:~:~:~:~:~:~:~:~:;:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:;:~:~
!~!~!~!!~!~:~!~:~:~:!~:!~:!~!~!~!~!~!~!~!~!~!~!~!~!~!~:~!~!~ ~I'I'I'I'I!I'I'I'I!I!I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'I'! .......................................................................................................................
reasonable
•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••.•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••w ••• ••••••••••••••••••••••••••••••w ••••••••••.••••••.•••:..•••.••••:••.••••.••.•••••.•••••••w ••w ••••••..••.•••••.•••::••••••••
little
Regime 1" No extension standard
good
advanced
Organizational manageability
Hazard Class 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . :~:~:~:~:~:~:~:~:~:~:~:~:~:.:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:.:~:~:~:~:~:~:~:~:~:~:~:.:`
Technical control
Regime 3: Beyond T0102
great
reasonable
little
Regime 1 No extension standard
good
advanced
Organizational manageability
Figure 2" Determination of the extent of flexibilization
Advances in Safety and Reliability: ESREL '97
687
After the determination of the applicable inspection regime the length of the inspection interval can be established. In regimes 1 and 2 this follows the rules of T0102. In regime 3 the inspection interval may exceed the maxima given in T0102, and a maximum of technical manageability is therefore required. In this regime the inspection interval is determined on the basis of the residual lifetime for the equipment concerned; this means that the degradation of condition and therefore the progress of the relevant damage process must be predictable. In fact, knowledge of the progress of damage, together with knowledge of the minimum required condition for the equipment concerned leads to a prediction of the residual lifetime. The maximum permissible inspection interval is based on a defined fraction of the predicted residual lifetime, see figure 3. Naturally, situations are possible in which the inspection interval so calculated is shorter than the maximum interval specified in T0102. In fact, the term 'interval extension beyond T0102' means in principle beyond T0102. Thus in regime 3 there is a question of a flexible inspection interval indeed.
Condition Inspection period t~ = safety factor * tR
Residual lifetime tR Minimal condition
.............................................................................. .,~...4~ P . ~ ..................
t~
J
Time
Figure 3" Determination of the inspection internal based on residual lifetime In order to determine the maximum permissible interval a factor of safety is used, that expresses the relationship between the residual lifetime and the maximum inspection interval. A value of 4 is used as standard. Moreover, this value is dependent on the organizational manageability. If the actual level of the organization increases, the safety factor may reduce to the value 3 or even value 2. A higher level of operating organization thus leads to a longer inspection interval. From the selected division into inspection regimes according to figure 2, it appears that the influence of the organizational manageability is very small for hazard classes 1 and 2. According to the manner of working given above the influence is, contrariwise, expressed by the safety factor applied and thus the length of the inspection interval. The calculation of the residual lifetime on the basis of damage progress is naturally possible only if one or more damage processes actually takes place. In the event that no damage process can occur (according to the international state-of-the-art), the residual lifetime is assumed to be infinite. For such a case the inspection interval is limited by an absolute maximum, i.e. five times the regular interval (cf. TO 102).
688
J.H. Heerings and J. Boogaard
DETERMINATION OF THE HAZARD CLASS Various classification schemes exist for the purpose of assigning plant to a safety, damage or effect category. The methodology proposed here uses assignment to 'hazard classes 1, 2 or 3' according to the RToD, sheet G0701. The following parameters are taken into consideration in the determination of the hazard class according to G0701: flammability, toxicity, quantity, pressure, temperature, presence of an enclosure. The most important reasons to work with this methodology are: * for all existing pressure vessels the applicable hazard class is known, so that no additional effort is required for assignment; * compliance with the RToD and current practice for requesting interval extension according to T0102. In the long term, although a choice has been made for assignment according to G0701, it may be better to select another system. An important disadvantage of G0701 is that it takes no account of the financial consequences and the possible effects on the continuity of production.
DETERMINATION OF THE TECHNICAL AND ORGANIZATIONAL MANAGEABILITY A questionnaire has been drawn up to assist in the determination of both the technical and the organizational manageability, which considers all the aspects that may be of influence. The technical control is qualified as little, reasonable or great. The qualification 'great' can be assigned only if it is possible to predict the deterioration of the integrity of a plant. This must be proved in the form of a graph in which not only the deterioration in condition, but also the minimum required level (corresponding to the 'end of lifetime') is given for the piece of equipment concerned. If such a prediction is possible, the reliability of the prediction must also be quantified: a questionnaire for this is also available. The organizational manageability is qualified as standard, good or advanced. The term 'standard' refers broadly to an organization in which inspection is based mainly on the observance of legal requirements; for the qualification 'good' inspection is explicitly directed towards the maintenance of integrity, while the term 'advanced' is applicable if management comprises combined inspection, maintenance and production. In order to make an objective and uniform judgement, criteria have been formulated for each question against which the answer to that question can be checked, and assignment to one of the above-named qualifications is possible. An important benefit of this approach is that it shows clearly which aspects are determinant (or: form the critical factor) for the final judgement, so that there is direct insight into what improvements could lead to a higher score.
SOME EXAMPLES In the development project the methodology has been applied to the following four cases. Creep of steam pipes Steam pipelines are subject to creep, fatigue (both low cycle fatigue and high cycle fatigue), thermal shock and corrosion during a shut-down. In most countries the inspection is intensified after a certain operating time is exceeded, mostly set by the value 0,6 for the so-called 'usage factor'. Extension of inspection intervals can therefore only be considered before the usage factor reaches the 0.6 threshold value. The degree of extension appeared to be limited to the maximum intervals from T0102 because of the potential occurrence of low cycle fatigue.
Advances in Safety and Reliability: ESREL '97
689
Internal corrosion in urea production plant In a certain part of a urea production plant general corrosion may take place due to the presence of a carbamate solution in a stainless steel pipeline. The corrosion rate is typically 0,05 to 0,10 mm per year in case of passive corrosion. Nevertheless, uncontrolled processing may lead to active corrosion with a very high rate. In order to detect a possible change from passive to active corrosion a measuring device has been installed based on the principle of neutron activation. The evalution showed that the inspection intervals may be defined based on the residual lifetime. Corrosion under insulation In a given naphta plant it has been shown that corrosion under insulation of pipelines may occur after 10 till 15 years after commissioning. In order to control this type of degradation the use of currently available NDT methods is not considered sufficiently. An integral approach is needed including training of maintenance and production personnel, quality control and guidance during application and specific inspections. In future reliable NDT techniques may be developed. In the current situation no extension of the inspection intervals appeared possible. Steam drums Potential degradation may occur as a result of cracking due to thermal stresses (high gradients during start-up and shut-down) and standstill pitting corrosion. The control of the temperature gradient accross the wall and in time during start-up is considered an effective measure apart from measurements of oxygen, pressure and water level. Ultrasonic inspection from the outside may be considered an alternative for internal inspection. The inspection interval could be based on the assessment of the residual lifetime provided sufficient control of the temperature gradient is ensured. Application of the newly developed methodology on the above mentioned cases showed that the broad analysis, as expressed by the methodology, is really necessary in order to arrive at a good judgement, and that application of the methodology leads to a correct insight into the actual manageability. Depending on the particular case, the conclusion was that extension of the interval was: not possible, possible according to T0102 or beyond it. An overview of the rating of the three determining factors, together with the conclusion regarding the inspection regime, is shown in table 1. It must be noted here that the evaluation for particular cases is based on an overall exercise with the methodology, so that the conclusions can not be considered as definitive. TABLE 1 OVERVIEW APPLICATION METHODOLOGY Hazard class
Technical control
Organizational Manageability
Inspection regime
Creep of steam pipes
1
reasonable
not determined
extension up to TO 102
Internal corrosion in urea production plant
2
great
good
beyond T0102
Corrosion under insulation
2
small
not determined
no
Steam drums
1
extension great
standard
beyond T0102
690
J.H. Heerings and J. Boogaard
BENEFITS
The methodology formulated here shows a number of l~enefits. A logical and effective programme of inspection can be drawn up that is well matched to the overall production process because use is made of the actual situation (the real damage processes) and the degree of manageability. Although during development of the methodology the area of applicability and the conditions of the Dutch Rules for Pressure Vessels (particularly T0102) were closely considered the results do not have to remain restricted to these. The checkable criteria provide clarity for both the inspecting authority and the user regarding the conditions under which inspection programmes are justified (and permissible). The user gains the possibility of compensating for the costs associated with a high degree of management (both technical and organizational) of the technical integrity by applying modified inspection intervals so that the economics of production can be optimized.
WHAT NEXT? Extensive validation of the systematics has not yet taken place. The methodology presented here must be considered as a guideline, while it is clear that modifications and supplements will be required before national acceptance is possible. The methodology offers the basis for a clear and systematic discussion regarding the flexibility of inspection intervals. In addition it is certainly possible to modify and further develop it during a "validation phase". In the meanwhile it has appeared that this opinion is shared by many process industries and the Dutch advisory committee "Technical Committee for Pressure Vessels". Therefore, a collaborative programme has been defined, to be started in the beginning of 1997. This programme is aimed at achieving national acceptance of the concept of'risk based inspection' in the Dutch Rules. The objective will be realised by the evaluation of a number of process units making use of the newly developed methodology.
REFERENCES
[11
Dutch licensing authority Stoomwezen (1994). Rules for Pressure Vessels, Staatsuitgeverij, Den Haag, NL.
[2]
Heerings, J.H. (1995). Final report "Condition monitoring of process equipment", KINT, Heemstede, NL (in Dutch).
[3]
Aller, J.E., Dunlavy, R. and Riggs, K.R. (1993). The Risked Based Managemend System: A New Tool For assissing Mechanical Integrity. ASME Reliability and Risk in Pressure Vessels and Piping PVP-Vol. 251, 115-125.
[4]
Reynolds, J.T. (1995). Risk based Inspection Improves Safety Of Pressure Equipment. Oil & Gas Journal, 37-40
B11" Modelling Physical Phenomena
This Page Intentionally Left Blank
UNCERTAINTY QUANTIFICATION IN PROBABILISTIC SAFETY ANALYSIS OF THE BLEVE PHENOMENON
I.A. Papazoglou, O. N. Aneziris Institute of Nuclear Technology-Radiation Protection, National Center for Scientific Research "DEMOKRITOS", Aghia Paraskevi 15310, Greece.
ABSTACT
This paper presents the methodology for risk estimation owing to the phenomenon of boiling liquid expanding vapour explosion (BLEVE), when either the model or its various parameters are not precisely known. BLEVE takes place when a tank containing liquefied petroleum gas (LPG) is exposed to fire and fails catastrophically. Two models have been used for the estimation of heat radiation to the population from a fireball namely the Emissive power independent of mass model and the Robert's model. In both models the thermal flux is expressed in terms of parameters like the radius, the duration and the maximum emissive power of the fireball, which might not be known precisely. The effect of uncertainty in the parameters on the estimated risk for both models is presented for a tank containing 200 tonnes of propane.
KEYWORDS BLEVE, Uncertainty, Risk assessment, chemical industry, LPG
INTRODUCTION
This paper presents the methodology for estimating the individual risk owing to the phenomenon of Boiling Liquid Expanding Vapour Explosion (BLEVE), when either the model or various parameters are not precisely known. BLEVE occurs when there is a sudden loss of containment of a pressure vessel containing a superheated liquid or a liquefied gas. The primary cause is usually an external flame impinging on the shell of a vessel above the liquid level, weakening the container and leading to sudden shell rupture. If the released liquid is flammable, a fireball may result. The procedural steps for quantifying risk for the specific case of the BLEVE phenomenon are presented. All uncertainties which appear in the BLEVE model such as the Emissive power, the diameter of the fireball, the duration of the phenomenon are described and quantified. Finally the results of the uncertainty risk assessment from BLEVE for a tank containing 200 tonnes propane are presented.
RISK A S S E S S M E N T OF F L A M M A B L E S U B S T A N C E S F R O M B L E V E
The methodology for quantification of risk from installations handling toxic or flammable substances has been presented in detail by Papazoglou et al. Here only the steps for risk assessment of the BLEVE 693
694
I.A. Papazoglou and O.N. Aneziris phenomenon will be described and in particular those for estimating the conditional (on a BLEVE) risk that is, the risk given that the BLEVE had occurred.
Consequence Assessment from BLEVE This phase aims at the establishment of consequences to the public and workers health and associated probabilities owing to the BLEVE phenomenon. Immediate health effects can be estimated by calculating the heat flux at each point around the site and the establishment of a thermal radiation/response model. The objective of this step is to determine the possible health effects and their conditional probabilities. Three steps can be distinguished for consequences from BLEVE: a) Estimation of heat radiation b) Dose assessment c) Consequence assessment Let Qr(x,y): dr(x,y): Pr(X,Y):
be the heat radiation at point (x,y). be the level of adverse exposure that is, the integrated over time exposure of the adverse effect. is the conditional probability of fatality for an individual at location (x,y)
The conditional probability of fatality pr(x,y) can be calculated as follows: BLEVE
radiation > Qr(x,y,t )
Dose >dr(x,y )
Probit > Pr(X,y )
Dose dr(x,y) is a function of heat flux and the duration tdof this phenomenon
dr(x,y ) = Qr(x,y)4/3tdlO -4
(1)
where: Q~ (x,y) is the thermal flux at point (x,y) (W/m 2) td is the duration of the BLEVE phenomenon (sec) The conditional probability of fatality for an individual pr(x,y) at location (x,y) in case of BLEVE is calculated from equations (2),(3) P-5
./.
2~
pr (x, y) = ~ expi-z)dU
(2)
P : - 1 4 . 9 + 2.561n(dr(x,y))
(3)
-oo
where : P is the "probit" value of the flammable substance due to heat radiation, proposed by the Green Book.
Heat Radiation Q The heat radiation Q which an individual may receive in case of a fireball can be calculated from the following equation:
Advances in Safety and Reliability" E S R E L '97 Q = E .... Gvv where: Q :radiation (W/m 2) E .... : emissive power per unit area (W/m 2) z~: atmospheric transmissivity, considered constant - 0.7 vv: view factor
695 [41
Emissive power
Emissive power is an uncertain parameter in the calculation of heat radiation. Two main approaches for the estimation of emissive power appear in the literature namely: a) Emissive power independent of mass, described in the Yellow Book and in CCPS/AIChE (1994) b) Emissive power depending on mass, proposed by Roberts A.F. and CCPS/AIChE(1994) Emissive p o w e r independent o f mass
According to this approach the maximum emissive power has a constant value, which does not depend on the mass of flammable substance. This value has been estimated from experiments. Three sets of experiments have been performed in the literature and their results appear in Table 1. The Yellow Book proposes 180 KW/m z and CCPS/AIChE(1994)350KW/m 2.
TABLE 1 EXPERIMENTAL RESULTS OF MAXIMUMEMISSIVEPOWER (Emax) Reference Fuels Fuel E max Mass[Kg) (KW/m 2) a] Hasegawa and Sato (1977) C5H12 0.3-30 110-413 bl Johnson et al. (1990) C4H10,C3H 1000-2000 320-375 8 clT.A. Roberts (1995) C3H 8 279-1708 320-415 Emissive p o w e r depending on mass
According to this approach the maximum emissive power is a function of the fuel mass, the radius and the duration of the fireball and is given by equation (5).
E
M'Hcf
max
=~
~ " D} . t d
(5)
where: f Fraction of heat release due to combustion that is radiated from the Fireball M Mass of combustion (Kg) Heat of combustion (J/Kg) Hc Df diameter of fireball (m) duration of fireball (sec) td maximum emissive power (W/m 2) Emax f is a function of pressure in tank and is calculated according to equation (6), proposed by Roberts A.F. f = 0.27 p0.32 where P is the pressure in tank in MPa.
(6)
696
I.A. Papazoglou and O.N. Aneziris View Factor
The view factor of a point on a plane surface located at a distance L from the center of a sphere with diameter DF depends not only on L and Dr but also on the orientation of the surface with respect to the fireball. The simplest case is when the surface is vertical and the view factor is given by Eqn. 7, as proposed by CCPS/AIChE (1989): VF
-4L 2
(7)
where: vv :view factor DF: fireball diameter L: distance from the center of the fireball For a point on the xy plane and co-ordinates (x,y) the distance L from the center of the fireball is assumed to be equal to: L = 4 ( D F / 2) 2 + x 2 + y2
(8)
Diameter o f the fireball
The equation which has been proposed by all researchers for the diameter of the fireball is the following: (9)
DF = aM b
where: DF" diameter of fireball (m) M" Mass of fireball (Kg) a,b: parameters Parameters a and b are not precisely known. Several researchers have proposed different values for these parameters as shown in Table 2. The fireball diameter might be treated an uncertain variable.
TABLE 2 VALUES OF PARAMETERS a, b, c, d FOR THE QUANTIFICATION OF THE BLEVE DIAMETER AND DURATION a
3.51 5.8 6.48 5.88 5.33 5.28 6.28 6.36
0.33 0.33 0.325 0.333 0.327 0.277 0.33 0.325
c 0.32 0.45 0.825 1.09 1.09 1.1 2.53 2.57
0.33 0.33 0.26 0.167 0.327 0.097 0.17 0.167
Reference Lihou and Maund 1982 Roberts 1982 Pietersen 1985, Yellow Book Williamson and Mann 1991 Moorhouse and Pritchard 1982 Hasegawa and Sato 1977 Fay and Lewis 1977 Lihou and Maund 1982
Duration o f the B L E V E p h e n o m e n o n
The duration of the fireball is an important factor in the assessment of Emax in the Roberts model (Eqn. 5) and of the dose in both approaches as evident from equation (1). The equation which has been proposed by all researchers for the duration of the BLEVE is the following:
697
Advances in Safety and Reliability: ESREL '97
t d = cM d
(10)
where: td : Duration of fireball (sec) M : Mass of fireball (Kg) c,d: parameters The parameters c and d are not precisely known. Table 2 also presents the values of c,d proposed by several researchers. Given the values of M, a, b, c, d and Emax (depending on the model), heat flux (Qr), dose (d r ) and individual risk (p~) can be calculated from equations (1)-(10).
QUANTIFICATION OF UNCERTAINTIES From the discussion in the previous section, it follows that the assessment of risk from the BLEVE phenomenon is characterised by lack of precise knowledge both in the associated models as well as in the value of their parameters. These uncertainties have been quantified for the two distinct models (i.e. the emissive power independent of mass approach and the Roberts approach)
Emissive power independent of mass
By virtue of Equations (1),(4),(7),(8),(9),(10) it follows that according to this model the dose is given by equation (11)
[
em oa+M X 2 +y2)
dr(x'Y)=L4((aMb/2)2
cMdlO-4
(11)
where: ~(x,y) Emax M x~ a,b,c,d x,y
Dose at point (x,y) (KW/m2)4/3sec emissive power per unit area (W/m 2) Mass of combustion (Kg) atmospheric transmissivity parameters coordinates
In this approach the uncertain parameters are: the maximum emissive power Emax, a and b (parameters determining the diameter of the fireball), c and d (parameters determining the duration of the phenomenon). Risk is calculated from equations (2),(3),(11) and is a function of these uncertain parameters: Pr = f(E m~x, a, b, c, d)
(12)
It follows that if uncertainty in these parameters is quantified by considering each of them as a random variable distributed according to a known probability density function (pdf), then Pr is also a random variable. A pdf for each random variable has been estimated based on data given in Table 2 and is presented in Table 3. Owing to the complexity of the dependence of the individual risk pr(x,y) on the uncertain parameters Emax, a, b, c, d the pdf of Pr has been estimated through a Monte Carlo simulation using the Latin Hypercube Sampling (LHS) method. Percentiles for the conditional individual risk Pr have been calculated for a tank of 200tn of propane as a function of distance. Results are shown in Figure 1 and discussed in the conclusions.
698
I.A. Papazoglou and O.N. Aneziris TABLE 3
PROBABILITYDENSITYFUNCTIONSofEmax,a,b,c,d Uncertain parameters
PDF
Emax a b c
Uniform (min: 200, max: 350) Logistic (mean: 5.655, parameter ~: 0.537) Normal (i" 0.319,0" 0.02) Rayleigh (parameter b" 1.037)
d
Triangular (min: 4.7 10-2, most likely: 0.19,max: 0.38)
1.00E+O0
5% Perc
.OOE-O
~,
- - - 10% Perc
\ I~i~ /~~ ~"£"~'i',,. "\\~ /lii~ ~\i'\.",,,,\\\\~
1.00E-02 1.00E-03
~'\'.'-\ \"
1.00E-04 ,.OOE-05
:\"" \ \
, ",
,.OOE-O6
1.00E-07
=~'
-
-
-
-
20% Perc 30% Perc 40% Perc 50% Perc
....
\ \
60% Perc
........... 70% Perc
Illi~| \\', k,."',, \\\
......
80% Perc 90% Perc 95% Perc
0
200
400
600
800
1000
1200
1400
1600
1800 2000
Distance (m)
Figure 1. Percentiles of conditional probability of fatality. Uncertain parameters Emax, a,b,c,d
Emissive power depending on mass (Robert's approach)
By virtue of Equations (1),(4),(5),(7),(8),(9),(10) it follows that according to this model the dose is given by equation (14)
I
fr,~ ~c M(l-d) dr(x'Y) = 4zcc((aM b / 2 i 2 + x 2 + y2 where: dr(x,Y) f M He
"[cc
a,b,c,d x,y
)14,3
cM d 10 -4
(13)
Dose at point (x,y) (KW/m2)4/3sec Fraction of heat release due to combustion that is radiated from the Fireball Mass of combustion (Kg) Heat of combustion (J/Kg) atmospheric transmissivity parameters coordinates
In this approach the uncertain parameters are: a,b,c and d. Risk is a function of these uncertain parameters and is given by the following equation (14). Pr = f(a,b,c,d)
(14)
Advances in Safety and Reliability: ESREL '97
699
The pdf's of a,b,c,d have already been presented in Table 3. A similar approach was followed and the percentiles of the pdf of conditional individual risk Pr for a tank of 200 tonnes are shown in Figure 2 and discussed in the conclusion. 1.00E+O0
5% Perc -
1.00E-01
"
-
10% Perc
-"20%
Perc
1.00E-02
30% Perc
1.00E-03
40% Perc 50% Perc
1.00E-04
. . . .
1.00E-05 1.00E-06
60% Perc
. . . .
70% Perc
......
80% Perc
- - - - - - 90% Perc 95% Perc
1.00E-07 1.00E-08 1.00E-09 0
200
400
600
800
1000
1200
1400
1600
1800
2000
Distance (m)
Figure 2. Percentiles of conditional probability of fatality. Uncertain parameters a,b,c,d
CONCLUSIONS Figure 1 presents some of the percentiles of the individual risk versus distance for the independent of mass emissive power model. These results can be interpreted as follows: at a distance of 600 m from the center of the fireball the conditional probability of fatality (Pr) is less or equal to 9xl 0 -9 with probability 50%, less or equal to 4x10 -7 with probability 60%, less or equal to 10-5 with probability 70%, less or equal to 5xl 0 -4 with probability 80%, and less or equal to 8xl 0 -2 with probability 95%. Figure 2 presents the corresponding results for the dependent on mass emissive power model. At a distance of 600 m from the center of the fireball the conditional probability of fatality (Pr) is less than 10-4 with probability 5%, less or equal to 8x10 -4 with probability 20%, less or equal to 2x10 -3 with probability 40%, less or equal to 8x10 -3 with probability 60%, less or equal to 2x10 -2 with probability 80% and less or equal to 7x10 -2 with probability 95%. It is noteworthy that the model allowing the emissive power to depend on the mass of the substance involved in the BLEVE phenomenon provides results characterised by less uncertainty than the model assuming no such dependence. For example, the 90% confidence interval for the distance beyond which the conditional individual risk is above 10.3 is [550m, 750m] for the former model while it is [200m, 800m ] for the latter. Furthermore it is noteworthy that the upper limit of the distance beyond which the level of individual risk is less than any given value is almost the same for the two models. For example, individual risk will be less than 10.5 beyond 900m with probability 95% for both models. Decisions, therefore, that require such a high degree of confidence do not depend on the choice of the BLEVE model. On the other hand if such high degree of confidence is not justified by the associated implications further research is required to establish the relevant validity of each model and reduce the associated uncertainties.
REFERENCES
CCPS/AIChE. (1994). Guidelines for Evaluating the Characteristics of Vapor Cloud, Explosions, Flash Fires, and BLEVEs, AIChE, New York" CCPS/AIChE.
700
I.A. Papazoglou and O.N. Aneziris CCPS/AIChE. (1989). Guidelines for Chemical Process Quantitative Risk Analysis, AIChE, New York: CCPS/AIChE. Fay, J.A., and Lewis, D.H. (1977). Unsteady burning of unconfined fuel vapour clouds. Sixteenth Symposium (International) on Combustion, 1397-1404. Pittsburgh: The Combustion Institute. Hasegawa, K. and K. Sato. (1977) Study on the fireballfollowing steam explosion ofn-pentane. Second Int. Symp. on Loss Prevention and Safety Promotion in the Process Ind., pp 297-304. Heidelberg. Johnson, D.M., M.J. Pritchard, and M.J. Wickens, (1990). Large Scale catastrophic releases of flammable liquids. Commission of the European Communities Report, Contract No EV4T.0014.UK(H). Lihou, D.A., and Maund, J.K. (1982). Thermal radiation hazard from fireballs. I. Chem. E. Symp. Ser. No. 71, pp 191-225. Moorhouse, J., and Pritchard M.J. (1982). Thermal radiation from large pool fires and thermals-literature review. I. Chem. E. Symp. Series No. 71. Papazoglou, I..A., Aneziris, O., Bonanos, G., and Christou, M. (1996). SOCRATES: a computerized toolkit for quantification of the risk from accidental releases of toxic and/or flammable substances, in Gheorghe, A.V. (Editor) Integrated Regional Health and Environmental Risk Assessment and Safety Management, published in Int. J. Environment and Pollution, Vol. 6,Nos 4-6,pp. 500-533. Pietersen, C.M. (1985). Analysis of the LPG incident in San Juan Ixhuatepec, Mexico City, 19 November 1984, Report TNO Division of Technology for Society. Roberts, A.F. (1981). Thermal Radiation from Releases of LPG from Pressurised Storage, Fire Safety Journal,4, 197. Williamson, B.R., and Mann, R.B. (1981). Thermal hazards from propane (LPG) fireballs. Combust. Sci. Tech. 25:14-145. Yellow Book. Committee for the Prevention of Disasters. (1992). Methods for the calculation of physical effects of escape of dangerous materials, TNO, Voorburg, The Netherlands.
EXTENDED MODELLING AND EXPERIMENTAL RESEARCH INTO GAS EXPLOSIONS W.P.M. Mercx TNO Prins Maurits Laboratory PO Box 45, Rijswijk, The Netherlands
ABSTRACT This paper summarises the work that has been performed by the nine participants in the project EMERGE, which was partially funded by the European Commission. The general aim of the project was to improve the various techniques of predicting the effects of gas explosion. A large number of experiments have been carried out on various geometrical scales with realistic obstacle configurations. The data have been used to investigate and validate submodels used in the various CFD codes capable of simulating the gas explosion process. Special items studied comprised: • the influence of pre-ignition turbulence on the explosion process; • the interaction of the explosion-induced expansion flow with obstacles; • the load induced on obstacles located in the combustion zone. KEYWORDS Gas explosion, experimentation, turbulence, explosion load, computerised simulation, obstacles. INTRODUCTION A project called 'Extended Modelling and Experimental Research into Gas Explosions (EMERGE)' has been carried out, partly sponsored by the European Commission DG XVII in the 'Environment' programme. EMERGE is a follow-up project of MERGE (Modelling and Experimental Research into Gas Explosions). An initial step has been taken in the project MERGE to collaborate on research concerning gas explosions. A number of experimental programmes were performed in MERGE to generate data on the influence turbulence has on flame acceleration and overpressure generation. Especially the influence of obstacles present in the gas cloud and the influence of jets have been investigated. Experiments were performed on various geometrical scales to study the influence of scale. The modelling part of MERGE consisted of the improvement of Computational Fluid Dynamics (CFD) models capable of simulating gas explosions. The experimental results were used for code validation and for validation of various scaling techniques (Mercx, 1995a). A similar approach was adopted for EMERGE. This project also consisted of two main parts; an experimental and a modelling part. Again the experiments were devoted to studying the influence of turbulence. As a difference to MERGE, the experimental set-ups were more complex in order to comply better with realistic situations. Also, the influence of initial turbulence, turbulence already in existence before ignition occurs, on the explosion process has been studied. The modelling part in EMERGE concentrated on the improvement of sub-grid obstacle modelling as applied in CFD codes. The outcome of EMERGE has been reported in Mercx et al. (1997). This paper gives an overview of the main activities that were performed. Within the restricted volume of this paper, it is inevitable that a selection is made from large number of activities carried out in this project. 701
702
W.RM. Mercx
OBJECTIVES The key objective of the project was to simultaneously improve the accuracy and establish the applicability of techniques to predict the characteristics of a vapour cloud explosion, i.e.: • experimental scaling techniques, since they have the potential to simulate in detail large-scale explosion behaviour in smaller scale experimental rigs; • simple approximate theoretical tools for routine use by industrial hazard engineers; • models based upon Computational Fluid Dynamics (CFD), which provide the most practical and cost effective route for extrapolating from large-scale experiments to full-scale scenarios. Since the greatest confidence lies in the results of large-scale experiments, the project aimed to establish a significant large-scale data set against which the predictive methods can be evaluated. In addition, a substantial fundamental data set is provided, against which the relative accuracy of the various sub-models used in the theoretical techniques can be evaluated and further developed. A number of deficiencies have been identified in the present knowledge of each of the three predictive techniques. There is still a need to establish the valid range of application of the scaling techniques and, in particular, it remains to be determined whether the methods can be applied more accurately. The guidance available for the application of simple practical explosion source models is limited and needs a better physical footing. The following uncertainties in the sub-models used in the applicable CFD codes have been identified: • the accuracy with which loads on structures can be predicted; • drag and momentum losses caused by realistic obstructions in steady and transient flows; • turbulence and detailed flow structures caused by steady and accelerating flows over different shaped obstacles; • the effects of initial turbulence and jet flows on the turbulent combustion rates and the detailed structure of a turbulent explosion flame. TASKS The work programme ofthe project was subdivided into a number of tasks in order to cover the deficiencies identified: 1. experiments to determine the influence of realistic obstacle and release environments on the explosion source strength; 2. further development of experimental scaling and simple model predictive techniques for the explosion source; 3. experimental measurements of the loads on structures within the combustion zone; 4. further development of numerical models for predicting loads on structures within the combustion zone; 5. detailed measurements of drag loads and turbulence characteristics on structures in unidirectional steady and transient flow past structures; 6. extended validation of sub-grid drag models used in numerical codes; 7. detailed experimental measurements of the effects of obstacles and pre-ignition turbulence in explosions; 8. further development of numerical sub-models based on the results of the previous task. Given the limited length of this publication, a selection has to be made of the studied subjects to be presented here in more detail. Therefore, only the work performed in tasks 1 and 6 will be highlighted. E X P E R I M E N T S TO INVESTIGATE THE INFLUENCE OF AN INITIAL TURBULENCE FIELD ON THE EXPLOSION PROCESS
Test set-ups The typical obstacle configuration used in the MERGE project was again used to perform small-, mediumand large-scale tests in order to extend the MERGE database in a consistent way. The MERGE obstacle configurations typically consisted of a number of cylinders orientated in three perpendicular directions. Configuration parameters were the number of cylinders, the cylinder diameter and the distance between cylinders. The outer dimensions of the obstacle configurations were scaled 1:2.25:4.5 for small-, medium- and large-scale, respectively. Obstacle diameters and distances were scaled accordingly. Typical outer dimensions were approximately 2x2xlm 3, 4.5x4.5x2.25m 3 and 9x9x4.5m 3 (Mercx et al., 1995b). Ignition was always in the centre of the array at ground level.
Advances in Safety and Reliability" ESREL '97
obstacle
703
t pipe
boundary
X
~, spark
obstacle
ly
PlanView
Tz
jet pipe
jet pipe
// I1~\
I
j EMERGEobstacle JIi
~.. ~
i / , x
z/
groundlevel \
•
•
•
•
I/
II~'l •
I
spark location
Figure 1" Schematic view of obstacle configurations with installed turbulence generating jet lances In order to obtain an initial turbulence field which could be reproduced on the three geometrical scales, four lances were installed symmetrically in the obstacle configurations. The turbulence field was created by the interference of four jets flowing through the lances. A schematic overview is shown in Figure 1. A similar four lance set-up for the generation of turbulence was used in the scaled-down mock-up of an offshore platform module in order to study initial turbulence in a realistic environment. Furthermore, tests were done in a tent without additional obstacles to study the influence of the initial turbulence field separately from the influence of turbulence created by the expansion flow interaction with obstacles. Results
Quantification of turbulence field Initial experiments were performed to quantify the required flow to obtain a reproducible turbulence field on the three geometrical scales. Values for the r.m.s, turbulent velocity should be preferably in the range of 1-2 m/s and in the range of 10-20 rn/s for a so-called low and a high initial turbulence field, respectively. Laser Doppler Anemometry as well as Pulsed Hot Wire Anemometry were used to quantify the turbulence field. It appeared that an initial turbulence field could be created only in the immediate vicinity of the ignition point. The region of the turbulence field extended to about two obstacles distances in each direction from the ignition location. Comparison of r.m.s, values for small- and medium-scales showed that the turbulence levels could be reproduced at similar sample points within a variation of about 20%. Figure 2 shows pictures of two gas explosions in a tent at a late stage of flame propagation for two different flow jet modes: no jet flow (zero turbulence) and medium initial turbulence. These pictures clearly demonstrate the influence of the initial turbulence field. Initial flame speeds were higher when there was initial turbulence. Flame speeds reduced when the flame left the initial turbulence region.
Tests in regular obstacle arrays All tests were done with roughly stoichiometric mixtures of methane or propane in air. In some tests, the oxygen content was increased according to (Catlin, 1991) to simulate the tests on the larger scales with the same mixture but without oxygen enrichment. Tests were done with three levels of initial turbulence: none, low and high.
704
W.RM. Mercx
The small-scale tests were all done with an obstacle diameter D of 19.1 mm and an obstacle distance of 4.65D. The obstacle arrays had either 12 or 20 cylinders in each horizontal direction. The maximum overpressures averaged on the sample locations inside the obstacle configuration varied from 7 kPa for the methane, no initial turbulence, 12 cylinders in a horizontal row configuration, to 140 kPa for the propane, oxygen-enriched to 24%, high initial turbulence, 20 cylinders in a horizontal row configuration. Sixteen medium-scale tests were reported. The obstacle diameter used was 43 mm. Obstacle distances of 4.65D (20 cylinders in a horizontal row) and 7D (14 cylinders) were used. Averaged maximum overpressures varied between 14 kPa for the case of methane/air with obstacle distance of 7D, to 325 kPa for the case of propane/air, oxygen concentration 22.5% and obstacle distance of 4.65D. A total of four large-scale tests were performed with an obstacle diameter of 82 mm and an obstacle distance of 4.65D. Averaged maximum overpressures were 100 kPa for methane/air and 300 kPa for propane/air mixtures. All large-scale propane and medium-scale propane, oxygen-enriched tests exhibited transition to detonation. The overpressures given above are for the fast combustion process, not for the detonation process, which generated pressure spikes with far higher overpressures. It appeared that the maximum overpressure was not influenced by the level of initial turbulence as was expected. Results were comparable to those obtained in MERGE. The only remarkable difference noticed was the time of maximum overpressure (Figure 3). Apparently the flame is accelerated in the very early stage where it is still in the region of initial turbulence. As flame speeds are relatively low then, no increase in overpressure is noticed. Outside the region of initial turbulence, the flame decelerates until the expansion flow-induced turbulence takes over and accelerates the flame to high flame speeds and accompanying overpressures.
Figure 2.a: Late stage of flame propagation; no initial turbulence (propane/air mixture), (picture from Christian Michelsen Research)
Advances in Safety and Reliability" ESREL '97
705
Figure 2.b: Late stage of flame propagation; low initial turbulence (methane/air mixture), (picture from Christian Michelsen Research) Tests in scaled offshore module The flammable mixture with which the mock-up was filled was ignited at several locations; in the focus of the four jets like in the TNO-PML and BG tests as well as at other locations. Increase in overpressure was noticed only when the ignition location was in the focus of the four jets. Contrary to the tests with the regular obstacle configurations, the overpressures increased by 50 to 80%.
,...-.,
1.000 -
::i:
..Q v (D
i. (b)
;7!
:3
o~ 0.750 -
(a)
o')
> 0
i' ! : i :
0.500 -.~
~
g/
0.250
i:!
i
0.000
I
0.0
'
J
'
'
~
~
'
I
I-
I
100.0
~
I
I
~
I
I
i
I
I
I
I
I
I
I
I
I
i
2000.0
I
I
I
i
I
I
I
I
300.0 time (ms)
Figure 3: Comparison of overpressures and times of maximum overpressures for the large-scale methane tests for zero (a) (MERGE), low (b) and high (c) initial turbulence levels. (Figure from British Gas Research)
706
W.RM. Mercx
Evaluation The influence of the initial turbulence appeared to be very minor in the tests with regular obstacle configurations. It was limited to an enhancement of the flame speed in the early stage, by which the time to maximum overpressure was reduced depending on the level of turbulence. It is concluded that in cases with a larger region of initial turbulence, the additional acceleration of the flame will be continued and an increase in maximum overpressure may be expected. Overpressures were increased by initial turbulence in the offshore module tests although a similar system was used to produce the turbulence and the same level of initial turbulence was obtained. The difference may be that, due to the difference in obstacle size, the turbulence length scale was different in both situations. O V E R A L L C O D E VALIDATION: P R E D I C T I O N OF L A R G E - S C A L E E X P L O S I O N E X P E R I M E N T S W I T H INITIAL T U R B U L E N C E The explosion codes FLACS/CMR (van Wingerden et al., 1993), AutoReaGas/TNO-PML (van den Berg et al., 1994), EXSIM/Tel-Tek (Hjertager et al., 1992) and COBRA/BG (Catlin et al., 1995) were applied to calculate the initial turbulence gas explosion experiments. The modelling approach for ignition of the vapour cloud with initial turbulence is validated against the medium-scale experiments with initial turbulence. Predictions were performed for the corresponding large-scale experiments prior to their execution. This exercise is similar to the one performed in MERGE (Popat et al., 1996). Additionally, the Shell fractal scaling method was used to predict the large-scale test results based on the medium-scale test results. For a chanze in scale by a factor L, the fractal scaling theory predicts that • overpressure increase by a factor of L 0 7"1 " 2 and times by a factor of L 0"644. All codes were capable of predicting the main findings in the medium-scale experiments; namely that the peak pressure is not influenced much by the initial turbulence region close to ignition. It is only the time from ignition to peak pressure that is influenced. Figure 4 shows a typical result. All modellers used their own basic assumptions and mode.lied the initial turbulence field as was considered best for their code to come up with large-scale predictions. Predictions were made for all sample locations inside the vapour cloud. The results for the predictions in the sample point which was closest to the ignition point are given in Tables 1 and 2. The large-scale propane/air tests exhibited transition to detonation. No code is capable of simulating this process. The overpressures given in Tables 1 and 2 are for the deflagrative combustion. The band in percentage of the experimental result, in which the predictions can be found, are -40 to +7% for the peak overpressure, -70 to +20% for the duration and -47 to +65% for the time of maximum pressure. The predictions for methane and propane according the various codes are quite different, the propane pressure being consequently underestimated. The degree of agreement between predictions and experiments is somewhat better than in the previous exercise in MERGE.
3°I
n
C
20
m
10
0
0
-10
b
20
I
I 1 O0
I
140
I 180
time (ms)
-20
Figure 4: AutoReaGas calculations for medium-scale tests with zero (a), low (b) or high (c) turbulence intensity.
Advances in Safety and Reliability: ESREL '97
707
TABLE 1 COMPARISON OF CFD PREDICTIONS, SCALING AND MEASUREMENTS FOR BG METHANE/AIR LARGE-SCALE EXPERIMENTS IN TRANSDUCER LOCATION CLOSEST TO THE IGNITION LOCATION
Low turbulence
Experiment FLACS AutoReaGas COBRA EXSIM Fractal scaling
High turbulence
Pmax (kPa)
Duration (ms)
t(Pmax) (ms)
Pmax (kPa)
Duration (ms)
t(Pmax) (ms)
100 98 107 96 72 100
30 39 32 31 33 28
112 128 96 85 173 111
110 89 109 96 73 107
32 39 31 32 33 29
70 99 77 77 124 81
TABLE 2 COMPARISON OF CFD PREDICTIONS, SCALING AND MEASUREMENTS FOR BG PROPANE/AIR LARGE-SCALE EXPERIMENTS IN TRANSDUCER LOCATION CLOSEST TO THE IGNITION LOCATION
Low turbulence
Experiment FLACS AutoReaGas COBRA EXSIM Fractal scaling
High turbulence
Pmax (kPa)
Duration (ms)
t(Pmax) (ms)
Pmax (kPa)
Duration (ms)
t(Pmax) (ms)
330 261 245 192 232 223
14 24 24 24 23 19
90 128 81 70 120 94
320 257 278 193 229 294
39 23 25 23 17
101 99 65 63 71 62
CONCLUSIONS AND RECOMMENDATIONS An extensive research programme has been carried out in the field of gas explosions, of which only two items studied could be described in this paper. The research project comprised the performance of experiments as well as theoretical investigations. The large number of experiments performed on the various items was necessary to partially cover the lack of experimental data. Therefore, experiments were done at various scientific levels. They were done with a specific general subject in mind: to investigate the influence of pre-ignition turbulence. Experiments were done: • at a practical level, to study as realistic circumstances as possible; • at a generic level, to supply data detailed enough to investigate and validate practical as well as CFD-type models; • at laboratory level, to provide data for development and testing of submodels used in CFD codes; • at laboratory level, to perform fundamental studies on specific physical features with respect to gas explosions. The experimental data obtained form a valuable extension of the MERGE database. By studying the experimental results, a considerable step forward has been taken in understanding the mechanisms of a gas explosions. It has been demonstrated that the explosion effects in realistic circumstances might be more severe than would be expected a priori. Progress has been made in the development of practical models for source strength prediction. Fundamental research into turbulent premixed flames shows that the present level of modelling adopted in the CFD codes can give acceptable results for practical applications. However, much improvement is required before all details of the physics involved can be simulated satisfactorily.
708
W.EM. Mercx
The exercise of predicting the large-scale experimental results with CFD codes showed better results than the previous exercise in MERGE, although the situation to simulate was more complicated because of the initial turbulence field. Until now, research into gas explosions in realistic scenarios has been concentrated on the realistic representation of the obstacles and obstructions present in the gas cloud. Very high overpressure values were obtained in the experiments. It must be realised that most of the tests were done with homogeneous concentrations of the gaseous fuel. It can be questioned whether these high overpressures will also occur in situations with non-homogeneous concentration distributions. A future direction for gas explosion research should be the investigation of realistic flammable clouds.
REFERENCES Berg A.C. van den, The H.G., Mercx W.P.M., Mouilleau Y. and Hayhurst C.J. (1994). AutoReaGas - A CFD tool for gas explosion hazard analysis. Procs of Symp. on Loss Prevention and Safety Promotion in the Process Industries, 19-22 June, 1995, Antwerp, Belgium. Catlin C.A. (1991). Scale effects on the external combustion caused by venting of a confined explosion. Combustion and Flame, 83, 399-411. Catlin C.A. Fairwether M. and Ibrahim S.S. (1995). Predictions of turbulent premixed flame propagation in explosion tubes. Combustion and Flame. 102, 115-128. Hjertager B.H., Solberg T. and Nymoen K.O. (1992). Computer modelling of turbulent gas explosion propagation in offshore modules. J. Loss Prevention in the Process Industries, 5, 165-174. Mercx W.P.M., Johnson D.M. and Puttock J.S. (1995a). Validation of scaling techniques for experimental vapour cloud explosions investigations. Process Safety Progress, 14-2, 120-130. Mercx W.P.M. (1995b). Modelling and experimental research into gas explosions. Procs of Symp. on Loss Prevention and Safety Promotion in the Process Industries, 19-22 June, 1995, Antwerp, Belgium. Mercx W.P.M. (editor, 1997). Extended modelling and experimental research into gas explosions - final summary report for the project EMERGE, EC contract EV5T-CT-93-0274. TNO Prins Maurits Laboratory, Rijswijk, The Netherlands. Popat N.R., Catlin C.A., Arntzen B.J., Hjertager B.H., Solberg T., Saeter O., Lindstedt R.P. and Berg A.C. van den (1996). Investigations to improve and assess the accuracy of computational fluid dynamic (CFD) based explosion models. J. Hazardous Materials, 45, 1-25. Wingerden K. van, Storvik I., Arntzen B., Teigland R., Bakke J.R., Sand I.O. and Sorheim H.R. (1993). FLACS-93, a new explosion simulator. Procs of the 2nd Int. Conf. and Exh. on offshore structural design against extreme loads, ERA report 93-0843 pp 5.2.1-5.2.14, London, United Kingdom.
MODELLING OF A LOW DISCHARGE AMMONIA RELEASE Gilles Dusserre ~, Aude Bara 1 1Ecole Nationale Sup6rieure des Techniques Industrielles et des Mines d'A16s Laboratoire G6nie de l'Environnement Industriel 6, Avenue de Clavi6res, 30319 ALES Cedex
ABSTRACT Experiments have been carried out by the School of Mines on ammonia liquefied under pressure. The aim was to estimate the ability of the Gaussian models to predict concentration of heavy gases in the near field, when a quick response is needed in the form of orders of magnitude, e.g. for the firemen on a chemical accident. Using the Doury standard deviations cr leads to underpredict the concentration compared to those observed on the site. The Pasquill cr seem to give better results. Of course, those conclusions depend on the estimation of the atmospheric stability class, which is sometimes difficult since the meteorological measurements can be lacking. They are also dependent on the experimental conditions tested here, and particularly the discharge flow rate. So the results given in the present paper can not yet be extended to larger releases as can be expected on real accidents.
INTRODUCTION The present firefighters are confronted to a particular kind of hazard : the spillage of toxic or flammable substances which can occur whether during the transportation or in an industrial storage. In case of such an event the firemen need quick information on the chemical concentrations to which they can be exposed, in order to act as quickly but also as safely as possible. Since the integrated dispersion codes need the knowledge of many data, which may be impossible to collect or measure on the site, and as the 3-D models need a long time for calculation, the Gaussian models seem to be the most appropriate answer to this special kind of need. Lots of experimental heavy gas releases have already been carried out in Europe (Air,Freon mixtures released at Thorney Island(Koopman, 1988)) and USA (Ammonia tests of Desert Tortoise (Goldwire, 1986) which provided data to validate the models. But they all deal with large amount of hazardous materials and the concentrations measured deal with distances much greater than 100 meters. It seems important to collect data on smaller releases so as to validate the models in the near field, because accidents can occur at every scale, including continuous leaks on a small storage. In order to evaluate the ability of simple Gaussian models to predict the near-field concentrations resulting from the complex dispersion of heavy gases, the School of Mines has chosen to carry out some experiments on an airport located in the south of France. In the next sections the experimental conditions willbe described, and the observed concentrations compared to the predicted ones. 709
710
G. Dusserre and A. Bara
Experimental Facilities Since such experiments need a large and flat area, the present tests have taken place on an airport located in the South-France, which ground was made of dirt and gravel (maximum roughness of 1 cm). To warrant the safety of the experiments, the presence and help of the local firefighters was necessary. The tests also constituted a good practice for the firemen since the use of a toxic chemical placed them in conditions very similar to those of an accident. The chemical substance chosen was ammonia, since it is the only hazardous material having a heavy gas behaviour under particular conditions, coupled with a relatively low toxicity compared to other heavier-thanair gases like chlorine. The ammonia was stored liquefied under its vapour pressure (8,6 bars at 20°C) and released from a 44 kg bottle placed the head below in order to generate a 2-phase flow. The jet was pointed nearly horizontally at 30 cm above the ground. The discharge flow rate, measured by weighing the bottle before and after the release, was approximately 10 kg/min. Under the sluice-gate of the storage, a metallic pool was placed on the soil in.order to retain the liquid phase. An additional device prevented the firemen who were acting direclty on the bottle, from liquid ammonia projections. This appliance can be regarded as a factor reducing the ammonia concentration since it keeps the liquid phase at a colder temperature than the ambient one, thus reducing the evaporation of the ammonia pool. The ammonia concentration were determined by trapping the chemical in hydrochloric acid and measuring out the formed ammonium ions by the means of spectrophotometry with the Nessler reagent (Norme AFNOR NF T 90-015). The gas was pumped at a constant rate during the whole release. This device allowed to measure averaged ground-level concentrations as the cloud crossed over the measurements points (see Figure 1).
NH 3 Source
l
Pool
Wind 8m
--'11
"
6m .......... "/" / /
....
Measurement points
"--
e
/
3m./
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
N
e
\ \
0
• 13 m
• 25 m
I1 : 5ore~
35 m
k -3 m .\..................................................... .Q \
t /
\ p
/
-6 m ..... I)~..'N.,. ........................................................... ~
~..
Figure 1. Experimental facilities on the site
s
p
/
I
Advances in Safety and Reliability: ESREL '97
711
Two meteorological stations were measuring data continuously throughout the trials, at the heights of 2 and 4 meters : humidity level, ambient temperature, speed and direction of the wind. The atmospheric stability on the site was appreciated on the observation of the cloud cover and the averaged wind speed, in accordance with the Pasquill-Turner tables.
AMMONIA CLOUD BEHAVIOUR The ammonia is stored at a high pressure and a temperature above its boiling point. Thus its release to the atmosphere, driving to a decrease of the initial pressure to the atmospheric pressure, leads to a 2-phase flow. A thermodynamical flash occurs immediately as the bottle is opened. One fraction of the liquid cools to the ammonia boiling point (240 K) and spreads in the shape of a pool, as the other part of the liquid phase forms an aerosol. Indeed, under the violent depressurization, the liquid is broken up into droplets which are held up into the gaseous cloud (Mathias, 1991). The resulting cloud has the appearance of a dense white mist. This phenomenon can be increased, depending on the ambient humidity level, since the air moisture may condense in contact with the cold gas. The presence of the aerosols (Hodin, 1996) gives to the cloud a density much higher than the density of the surrounding air, and the cloud behaves as a heavy gas. It goes through a gravity slumping stage due to its excess density and air is entrained into it. Independently from the jetting influence due to the release way, the cloud dispersion is greatly influenced by the wind (Koopman). It can accelerate the dispersion of the gas by increasing the entrainment of air and the evaporation of the aerosols. When the cloud is sufficiently diluted in the ambient air, it behaves as a passive gas and the dispersion is only due to the natural atmospheric turbulence.
Experimental results In this paper, we have chosen to present one of the several tests carried out since january 1996, that is the release made on July, 25th.
Meteorological conditions on July 25th The data measured on the site on this day are presented in table 1.
TABLE 1 : METEOROLOGICALCONDITIONSON JULY, 25TH. Ambient Temperature Humidity Level Wind Speed Wind Direction
16°C 58% 4 m/s South-East
The sky being cloudy, and taking into account the wind speed of 4 m/s, we can estimate that the atmospheric stability class was C or D, in accordance with the Pasquill-Tumer definitions (Turner, 1967).
712
G. Dusserre and A. Bara
Ammonia concentrations The table 2 presents the ammonia tenors (ppm) measured on the site.
TABLE 2. AMMONIA TENORS(PPM) ON THE 25 TH JULY TRIAL Crosswind Distances y (m) 8 6
-3 -6 -8
13
Downwind distances x (m) 25 35
50
860 ppm 2080 ppm
....
2620 ppm 2310 ppm 210 ppm
170 ppm
105 ppm
65 ppm
80 ppm 60 ppm
Unfortunately, the measurement axis did not coincide exactly with the main wind direction, which explains that the ammonia tenors are higher for y>0. We can estimate that there was an angle of approximately 15 ° between those 2 axis. This misalignement, which cannot be reproduced by any model (Duijim, 1996), is taken into account in the next section by comparing the predicted concentrations in the axis to the observed concentrations for the y>0.
GAUSSIAN M O D E L L I N G The Gaussian model used here is the puff model for continuous releases (Crabol, 1995). In accordance with the literature (Ftilleringer) and in order to adopt the crisis management behaviour (simple calculations), we will assume that 60% of the ammonia discharge participate in the formation of the cloud (flash and aerosols), i.e. a gaseous flow rate of 6 kg/min. The parameters used to measure the performance of the models are the Mean Relative Bias (MRB), the Mean Relative Square Error (MRSE) and the Factor-of-2 (FA-2) (Duijm, 1996). The MRB ranges from -2 to 2 with an optimum value of 0. A negative MRB indicates underprediction and a positive MRB, overprediction. The FA-2, currently used in the case of heavy gases, ranges from an optimal value of 100% to 0. For the present evaluation, the data at 50 m from the source will not be used because it was not possible to estimate the real ammonia tenor in the wind direction.
CEA-Doury model Taking into account the meteorological conditions observed, the atmospheric diffusion can be regarded as normal (Doury, 1984). The derived modelling gives the following results (Table 3). It allowed to calculate MRB=-0,847, MRSE=I,217 and FA-2=50% which indicate relatively poor performances. This is specially the case for the crosswind predictions (y¢0). But Doury has above all worked on nuclear dispersion problems, regarding longer distances (100 to 1000 km).
Advances in Safety and Reliability: ESREL '97
713
TABLE 3. PREDICTED TENORS (PPM) WITH THE DOURY SIGMAS IN ND
Crosswind Distances y
13
Downwind distances x (m) 25 35
50
(m) 0 3 6 8
3442 ppm 208 ppm
1153 ppm
656 ppm
361 ppm
30 ppm 17 ppm
Pasquill sigmas As explained above, the atmospheric stability can be evaluated as class C or D. Accordingly, two modellings have been done (Table 4 and 5).
TABLE 4. PREDICTED TENORS (PPM) WITH THE PASQUILL SIGMAS IN STABILITY C
Crosswind Distances y (m) 0 3 6 8
13
3471 ppm 774 ppm
Downwind distances x (m) 25 35
947 ppm
487 ppm
50
241 ppm
184 ppm 109 ppm
Under the atmospheric stability C, the performance parameters are : MRB = -0,317, MRSE=0,324 and FA2=67%. These results highlight the fact that the Pasquill model is better than the Doury prediction.
TABLE 5 PREDICTED TENORS (PPM) WITH THE PASQUILL SIGMAS IN STABILITY D
Crosswind Distances y (m) .0
13 8985 ppm 1206 ppm
Downwind distances x (m) 25 35
1430 ppm
736 ppm
50
365 ppm
290 ppm 8
172 ppm
For a stability class D, MRB=0,158, MRSE=0,378 and FA-2=83%. It shows that in this case the model is overpredicting the global concentrations, and particularly near the ammonia source.
DISCUSSION The following figure presents a comparison between the experimental data (in the presumed direction of the wind) and the different predicted concentrations, on the axis of the model. Seeing this graph, it appears that
714
G. Dusserre and A. Bara
the Doury and Pasquill models are equivalent in predicting the tenors in the axis. But it must be remembered that the crosswind concentration are much underpredicted by Doury whereas Pasquill gives better results. 9000
~Trial A Doury DN
8000 I 7000 A
E o
C
-
-'-
6000
Pasquill C4 Pasquill D4
5000 4000 3000 2000 1000 Distance
0 10
15
20
215
30
35
40
(m)
Figure 2. Comparison between the experimental and the predicted data.
CONCLUSION The Gaussian models could be employed to predict the near-field concentration in an emergency case, taking into account the special conditions tested during the present trials • low discharge flow, C or D atmospheric stability... IT also seems that Pasquill is better at predicting the crosswind tenors.
ACKNOWLEDGEMENTS We would thank the firemen from the local firestations of Ales and La Grand'Combe.
REFERENCES
Alp E., Mathias C.S., 1991, ~ COBRA : a heavy gas/liquid spill and dispersion modelling system )), Journal of Loss Prevention in the Process Industries, Vol 4, p 139. Crabol B., 1995, ~ Mrthodes d'rvaluation de la dispersion des gas dans l'atmosph&e >>,CEA. Doury A., 1984, t~ Une mrthode d'approximation instantanre de la dispersion atmosphrrique >), Rapport DAS n°52, CEA/IPSN. Duijm N.J., Ott S., Nielsen M., 1996, ~t An evaluation of validation procedures and test parameters for dense gas dispersion models )), Journal of Loss Prevention in the Process Industries, Vol 9, n°5, pp 323-338. Fiilleringer D., 1995, ~t Evaluation de la sfiret6 des installations utilisant de l'ammoniac )), Rapport du Ddpartement d'Evaluation de Sdretd, IPSN. Goldwire H.C., 1986, ~t Large-scale ammonia spill tests )), Chemical Engineering Progress, n°4, pp 35-40. Hodin A., 1996, ~t Modrlisation du drbit h la br~che et du jet grnrr6 par une fuite d'ammoniac en phase liquide: 6tat des connaissances et modrlisation des rejets diphasiques )), Note d'Etude, Direction de l'Equipement d'EDF, Centre Lyonnais d'Ingrnierie. Koopman R.P., 1988, ~t Atmospheric dispersion of large scale spills )), Chem. Eng. Comm., Vol. 63, pp 61-86. Koopman R.P., Ermak D.L., Chan S.T., 1989, tt A review of recent field tests and mathematical modelling of atmospheric dispersion of large spills of denser than air gases )), Atmospheric Environment, Vol 23, n°4, pp 731-745. Norme AFNOR NF T 90-015 ~ Dosage de l'Azote Ammoniacal )). Turner D.B., 1967, t~ Workbook of atmospheric estimates )), US Department of Health, Education and
Welfare.
B12, Pipeline Safety
This Page Intentionally Left Blank
RISK ASSESSMENT OF PIPELINES O. N. Aneziris, I.A. Papazoglou Institute of Nuclear Technology-Radiation Protection, National Center for Scientific Research "DEMOKRITOS", Aghia Paraskevi 15310, Greece.
ABSTRACT
Methodological steps for the Quantitative Risk Assessment of pipelines containing either toxic or flammable substances are presented. The effect of break location on the results is studied through a study of the sensitivity of individual risk on the number of possible break locations along the length of a pipeline carrying ammonia (toxic) or LPG (flammable). The computer package SOCRATES (Safety Optimization Criteria and Risk Assessment Tools for Emergency and Siting) has been used to indicate the effect of discretization of the pipeline on the isorisk contours as well as the area within a certain risk level.
KEYWORDS
Pipelines, Risk assessment, chemical industry, LPG, ammonia.
PIPELINE RISK A S S E S S M E N T
Many studies have been performed regarding the causes of pipeline failure and their frequencies as described by Geyer et al, Muhlbauer et al and Hovey et al, but only few for pipeline risk assessment such as the one performed by Bodner et al concerning release of toxic Hydrogen Sulfide.
Assessment of damage states and their frequency of occurrence The first step in Quantified Risk Analysis of a pipeline consists in identifying the potential damage states and the causes of failure. The main causes of pipeline failures are corrosion, overpressure, human error, third party damage and impact as described by Hurst et al and by Muhlbauer. Damage states are defined in terms of the size and location of the break and the phase of release. For certain causes of failure the location of the release can be determined (e.g. location of a valve which is inadvertently open owing to a human error). For other causes, like corrosion, the possible position of the break extends sometimes the entire length of the pipeline. It follows that at least one important parameter for damage state determination is characterised by uncertainty. 717
718
O.N. Aneziris and I.A. Papazoglou In this analysis this problem is addressed by considering a number J of possible break locations evenly distributed along the length of the pipeline and having equal probability of occurrence. Let f be the frequency with which a break is expected in a pipeline of total length L. Then the above assumption is equivalent to considering one installation (pipeline) characterised by J plant damage states (one for each possible location) each having a frequency of occurrence fj
fj-j
f
(1)
The paper calculates the effect on the calculated risk of the size J of possible break locations.
Consequences Assessment of the release of toxic orflammable material Next the consequences to the public and workers health owing to the release of hazardous substances must be established.
Toxic substances For toxic substances the assessment of the consequences involves the following procedural steps :
Determination of Release Categoriesfor Toxic Materials. A release category, defines all necessary physical conditions, phenomena and parameters that uniquely determine the concentration of a toxic substance at eachpoint in the area around the source or equivalently all the conditions (installation dependent and environmental) that affect atmospheric dispersion. It includes quantity and physical conditions of the substance released from its containment (outflow models), evaporation rate ( if released in liquid form), and weather conditions. Details for outflow and evaporation models are given by Papazoglou et al (1996) and by the Yellow Book. In the case of a pipeline break, the release category is defined by the diameter of orifice, the pump rate, the duration of release and the weather conditions required by the dispersion model. The considered weather parameters are: atmospheric temperature, weather stability, wind speed, and wind direction. Uncertainties have been assumed only in the weather conditions.
Atmospheric Dispersion of Toxic Materials. In this step a model simulating dispersion of a toxic substance is established. The model estimates the concentration of the toxic substance as a function of time and space. Each release category leads to a specific concentration level for each point of time and space. Atmospheric dispersion in this analysis has been calculated by a simple box model for dispersion of heavier than air gases over fiat terrain contained in "SOCRATES". The model is based the one presented by Jagger and is described by Papazoglou et al, 1992.
Dose Assessment. Given the concentration of the toxic substance an individual in the general area of the installation will receive a certain dose (inhalation) of the toxic substance. This depends also on any implemented emergency response plan. For toxic substances dose is calculated on the basis of concentrations calculated by the dispersion model and the exposure of an individual to these concentrations. For detailsthe reader is referred to Papazoglou et al, 1996 and the Green Book.
Advances in Safety and Reliability: ESREL '97
719
Consequence Assessment. A dose/response model receives as input the dose calculated by the dose model and calculates the probability of fatality for the individual receiving the dose (see Papazoglou et al, 1996 and the Green Book). Flammable Substances
A parallel set of major steps can be distinguished for the assessment of the consequences of released flammable substances.
Determination of Release categories of Flammable Material. A release category for flammable materials defines all necessary physical conditions, phenomena and parameters that uniquely determine the level of thermal flux or the overpressure at each point in the area around the emulsion source. For example, in the case of the LPG, it is established whether jet fire will take place or whether an explosion or flash fire will result following atmospheric dispersion of the gas.
Estimation of Heat Radiation and Peak Overpres~ure. In this step, a model for simulating the heat radiation or the peak overpressure resulting from the released flammable material and the associated physical phenomenon is established. Next the heat radiation and/or the peak overpressure is calculated. In case of a pipe release of a flammable substance which ignites immediately, the levels of Thermal Radiation as a function of distance are calculated according to the jet models. More details in the jet model are presented in the Yellow Book. If there is a break of a pipe containing liquefied flammable gas, the gas will disperse and if it encounters an ignition source the mixture of gas and air may either explode and cause damage to the surroundings owing to the shock wave, or burn as a flash fire in a short period (delayed ignition). Details on the flash fire and the explosion models are presented in the Yellow Book.
Dose Assessment. The integrated, over time, exposure of an individual to the extreme phenomenon generated by the flammable material is calculated. This defines the "dose" an individual receives. For substances causing high levels of thermal radiation effects dose is calculated on the basis of thermal fluxes while in the case of explosions in terms of the overpressure (see Papazoglou et al, or the Green Book).
Consequence Assessment Appropriate dose/response models receiving as input the dose of heat radiation or overpressure calculate the probability of fatality or injury of the individual receiving the dose (see Papazoglou et al, or the Green Book).
Risk Integration Integration of the results obtained so far, that is combining the frequencies of the various accidents with the corresponding consequences, results in the quantification of risk. Here the measure of individual risk is used. Individual fatality risk is defined as the 'frequency (probability per unit time) that an individual at a specific location (x,y) relative to the installation will die as a result of an accident in the installation. Individual fatality risk is usually expressed per unit of time (e.g. per year) of installation operation. Individual fatality risk is calculated as
720
O.N. Aneziris and I.A. Papazoglou
follows: Let j: be an index spanning the space of the possible break locations (j=l ..... J) r" be an index spanning the space of the possible release categories. (r = 1. . . . . R) f." be the frequency of the r th release category, of the jth break location Prj (x,y) " is the conditional probability of fatality for an individual at location (x,y) given release category r and the break location j. If now R(x,y) • is the frequency of fatality for an individual at location (x,y). (individual risk) It follows that : rj
R(x'Y)=~I~lP~J(X,Y)frj
(2)
It follows from equation (2) that for a given set of assumptions about weather conditions and other parameters affecting the release categories, R(x,y) depends on the degree of discretization (J) of pipeline.
R E S U L T S F R O M PIPELINE RISK A S S E S S M E N T
Risk assessment has been performed for two pipelines; one containing flammable LPG and the other toxic ammonia. Both pipes connect a ship containing the loading substance to a tank. Isorisk contours and the risk area between particular individual risk levels for pipelines with various break locations have been calculated and presented in the following. The above analysis has been performed with the computer code SOCRATES (Papazoglou et al, 1996).
PipelinecontainingflammableLPG A four inch and 1000m long pipeline loads a LPG tank at a rate 120 Kg/sec, when the ship pumps are operating. If it fails, LPG will be released to the environment for ten minutes. In case of immediate ignition a jet fire will occur, while in case of delayed ignition either a flash fire or explosion will occur. Isorisk curves (conditional on a break in the pipeline) in case of explosion following a release are given in Figures 1 and 2 for two cases a) 1 segment of 1000m and b) 50 segments of 20m. Table 1 gives the variation of the maximum distance between particular conditional risk levels as a function of the number of segments of the pipeline. It follows that this distance does not change with finer discretization after considering about two segments of 500m each. That is no substantial accuracy is achieved by segmenting the pipeline in more than 2 segments.
TABLE 1 MAXIMUM DISTANCE OF PARTICULAR INDIVIDUAL RISK LEVEL IN CASE OF EXPLOSION (m) i
i,
i
RISK LEVEL
NUMBER OF SEGMENTS 1
R=10 "4 R=10 "3 R=10 -2
970 670 450
2
930 690 370
5
10
2O
5O
930 670 370
930 670 370
930 650 370
930 650 370
Advances in Safety and Reliability: ESREL '97
721
A similar analysis has been performed in case offlash fire following a release. Table 2 gives the variation of the area between particular conditional risk levels as a function of the number of segments of the pipeline. It follows that the area within the various risk levels does not change with finer discretization after considering aboutfive segments of 200m each. That is, no substantial accuracy is achieved by segmenting the pipeline in more than 5 segments.
o
io~o
2000
2000
1000
-I000
2ooo
~6oo
2ooo
Figure 1: Isorisk curves (conditional) in case of Figure 2: Isorisk curves (conditional) in case of explosion. One segment, explosion. Fifty segments.
TABLE 2 MAXIMUM DISTANCE OF PARTICULAR INDIVIDUAL RISK LEVEL IN CASE OF FLASH FIRE (m) RISK LEVEL
R=I 0 °4 R=10 "3 R=10 -2
NUMBER OF SEGMENTS
1 810 560 310
2 810 510 270
5 810 520 220
10 810 520 220
20 810 520 220
50 810 520 220
Pipeline containing ammonia A 20 centimetres and 1000m long pipeline loads ammonia to a tank with rate 100 Kg/sec, when the ship pumps are operating. If it fails, ammonia will be released to the environment and the population will be exposed to the toxic cloud for ten minutes. Isorisk curves (conditional on a break in the pipeline) following a release are given in Figure 3 and 4 for the case of 1 segment and of 50 segments of 20m each, respectively. Table 3 gives the variation of the maximum distance between the pipeline and particular conditional risk levels as a function of the number of segments of the pipeline. It follows that the area within the various risk levels does not change with finer discretization after considering aboutfive segments of 200m each. That is no substantial accurany is achieved by segmenting the pipeline in more than 5 segments.
722
O.N. Aneziris and I.A. Papazoglou 4OOO
-3000
-3000
2000
"2000
1000
I000
-
1O00
0
! 2000
3000
•4 0 0 0
4000
0
Figure 3: Isorisk curves (conditional) in case of ammonia release with rate 100 Kg/sec for 600sec. One segment.
z6oo
1000
3o'oo
4ooo
Figure 4: Isorisk curves (conditional) in case of ammonia release with rate 100 Kg/sec for 600sec. Fifty segments.
TABLE 3 MAXIMUM DISTANCE OF PARTICULAR INDIVIDUAL RISK LEVEL IN CASE OF AMMONIA RELEASE 100Kg/sec for 600 see (m).
NUMBER OF SEGMENTS
'RISK LEVEL
R=10 -4 R=10 -3 R=10 "2 R=10-i ,,
1
2
5
1670 1250 825 450
1580 i140 7i0 300
'1580 1170 730 320
10 1580 1170 730 320
.
20 . . . . . . 50 " 1580 1580 1170 1170 ' ' '730' 730 . . . 320 320
......
,
Isorisk curves (conditional on a break in the pipeline) following a release are given in Figure 5 and 6 for the case of 1 segment and of 50 segments of 20m each, respectively, when the exposure time to the toxic cloud is reduced to five minutes. Table 4 gives the variation of the maximum distance between the pipeline and particular conditional risk levels as a function of the number of segments of the pipeline. It follows that the area within the various risk levels does not change with finer discretization after considering about ten segments of 100m each.
.
Advances in Safety and Reliability" ESREL '97
723
4000
4000
3000
-~000
2000
- 2000
1000 1000
o
,o'oo
2oo0
~obo
4000
' 3000
Figure 5: Isorisk curves (conditional) in case of ammonia release with rate 100 Kg/sec for 300sec. One segment.
zobo
~o'oo
-4ooo
Figure 6: Isorisk curves (conditional) in case of ammonia release with rate 100 Kg/sec for 300sec. Fifty segments.
TABLE 4 MAXIMUM DISTANCE OF PARTICULAR INDIVIDUAL RISK LEVEL IN CASE OF AMMONIA RELEASE 100Kg/sec for 300 sec (m). NUMBER OF SEGMENTS
RISK LEVEL
1
R = 10-4 R=10 -3 R=10 -2 R=10 -1
1175 725 450 250
2
1080 660 400 170
5
10
1070 660 380 150
1050 640 380 150
20
'1050 640 380 140
50
1050 640 i 370 120
CONCLUSIONS Discterization of pipelines for QRA purposes could play an important role in a certain class of decisions. From the examples presented here it follows that in case of flammable material the area of particular conditional risk level (e.g. 102) could extend up to 450 m from the pipeline with no discretization while only up to 3 7 0 m with discretization. This difference of 80 m per km of pipeline (each side) might be of rather significant value for pipelines of moderate to large lengths. In general the importance of discretization depends on the particular conditions of the accident and hence on the extend of the consequences of interest. The larger the extend of the consequences with respect to the pipeline length under consideration, the lower the importance of segmentation. This is exemplified by the case of ammonia release (100 kg/sec for 600 see) where the 10.2 individual risk area contains the 1 km pipeline in the case of one segment (Fig. 4). In this case discretization does not affect the results (see Table 3).
724
O.N. Aneziris and I.A. Papazoglou
If on the other hand the extend of the consequences is small with respect to the length of the pipeline as in the case of the shorter ammonia release (100 Kg/sec for 300 sec) then higher degree of discretization is required to realistically assess the required distances. It follows that a simple analysis like the one presented in this paper is recommended in cases of pipelines of significant lengths and/or where the value of affected land is of particular importance.
REFERENCES
Bodner, A.I., Greenwod, B.W., Hudson, J.M. (1990). Risk Analysis of a Sour Gas Pipeline Using Personal compute, Rel. Eng. And System Safety ,Vol. 30, 455. Geyer, T.A.W., Bellamy, L.J., Astley, J.A., Hurst, N.W. (1990). Prevent Pipe Failures due to Human Errors, Chemical Engineering Progress, November ,66-69. Green Book. Committee for the Prevention of Disasters. (1989). Methods for the calculation of possible damage, TNO, Voorburg, The Netherlands. Hovey, D.J., Farmer, E.J. (1993). Pipeline accident, failure probability determined from historical data, Oil & Gas Journal, July 12, 104-107. Hurst, N.W., Bellamy, L.J., Geyer, T.A.W., Astley, J.A. (1991). A classification scheme for pipework failures to include human and sociotechnical errors and their contribution to pipework failure frequencies, Joumal of Hazardous Materials, 26, 159-186. Jagger, S.F. (1983). Development of CRUNCH: A Dispersion Model for Continuous Releases of a Denserthan-air Vapour into the Atmosphere, SRD Report R229, UKAEA, Safety and Reliability Directorate, Warrington. LPG A Study, A Comparative analysis of the risks inherent in the storage, transhipment, transport and use of LPG and motor spirit, 10 Main Report LPG.(1983).TNO, Voorburg, The Netherlands Muhlbauer, W.K.(1992). A proactive approach to pipe line r'isk assessment, Pipe Line Industry, July, 29-31. Papazoglou, I..A., Aneziris, O., Bonanos, G., and Christou, M. (1996). SOCRATES: a computerized toolkit for quantification of the risk from accidental releases of toxic and/or flammable substances, in Gheorghe, A.V. (Editor) Integrated Regional Health and Environmental Risk Assessment and Safety Management, published in Int. J. Environment and Pollution, Vol. 6, Nos 4-6, pp. 500-533. Papazoglou, I. A., Christou, M., Nivolianitou, Z., Aneziris, O. (1992). "On the management of severe chemical accidents DECARA : A computer code for consequence analysis in chemical installations. Case study : Ammonia plant, Journal of Hazardous Materials, 31, 135-153. Yellow Book. Committee for the Prevention of Disasters. (1992). Methods for the calculation of physical effects of escape of dangerous materials, TNO, Voorburg, The Netherlands.
QUANTIFIED RISK ANALYSIS IN TRANSPORT OF DANGEROUS SUBSTANCES: A COMPARISON BETWEEN PIPELINES AND ROADS P. Leonelli 1, S. Bonvicinil, G. Spadoni 1 1Department of Chemical, Mining Engineering and Environmental Technologies, University of Bologna, Viale Risorgimento 2, 40136 Bologna, Italy
ABSTRACT
A study on Quantified Risk Analysis applied to transport of dangerous chemicals is presented. Particular attention has been devoted to the analysis of the societal risk, represented by means of F/N curves, arising from the transport of dangerous goods by both road and pipelines. The three steps which form the procedure for evaluating societal risk are described: first of all the modelling of population distribution namely the definition of the population map; the second step consists in identifying and describing all possible accidents that may occur during the transport of dangerous goods; finally a procedure must be applied, that allows to calculate the societal risk. Tests are carried out to compare societal risk resulting from pipeline and road transport of ammonia. The comparison of Quantified Risk Analysis results is performed resorting to the fuzzy logic, in order to take into account uncertainties connected with the identification of accidents.
KEYWORDS Dangerous good transportation, Societal Risk, Roads, Pipelines, F-N curves, Algorithm, Uncertainty evaluation, Fuzzy logic.
INTRODUCTION
The importance of assessing risks in transportation of dangerous goods has been shown by several historical analyses (Brockoff 1992) which pointed out how their magnitude is, in many cases, quite similar to that one resulting from chemical and process industries. As a consequence, the Quantified Risk Analysis, largely used to evaluate the impact of process industry' s risks on territory, has been recently adopted for analysing risk in transports too (Brockoff 1992; .Spadoni et al. 1995). In order to quantify the risk to which a population living in an industrialised area is subjected, the societal risk, represented by means of F/N curves (frequencies of accidents involving N or more fatalities), is usually evaluated. In the procedure here described, this important risk measure is evaluated by performing the following three phases. The first one is the identification, on a population map, of the areas of different densities for different land uses, where people may be considered uniformly distributed, of the roads (people linearly distributed) and of the aggregation centres (e.g. schools, hospitals and commercial sites). The modelling of population distribution also takes into account the probability of people to be indoor. 725
726
E Leonelli et al.
The second step consists of the identification and evaluation of all possible accidents that may occur during the transport of dangerous goods (in our calculations only transport of a toxic substance like ammonia is considered, but the procedure can deal also With other toxic substances like chlorine, or inflammables like motor spirit or LPG). The characterisation of the accidents - regarding likelihood and size of breakage; rate, physical aspect and duration of the release - has been carried out and then consequences and probit models are used to obtain vulnerability maps for each possible accidental scenario, which can be stored once and for all, because they do not depend on population distribution. In this way all possible accidental events are converted into both vulnerability distribution around the source risk point and related likelihood of occurrence. Finally a procedure is developed that allows to calculate the contribution to the societal risk of all people categories, by overlapping, with an efficient mathematical algorithm, vulnerability maps of the possible accidents on the user-defined impact area. The procedure describes the linear risk source, i.e. pipeline and tanker's route, as a sort of travelling accident:
POPULATION DISTRIBUTION MODEL As far as population modelling is concerned, a suitable description of the population distribution in the area of interest is requested. The population is subdivided in three categories: uniformly distributed, linearly distributed and aggregated in specific centres. Uniformly distributed population is described by partitioning the impact area into rectangular subareas, where population density may be considered uniform owing to the use of the subareas (e.g. residential quarter, urban area, park .... ). Points are used to describe centres of people aggregation, i.e. hospitals, commercial centres, schools and so on. Finally people on-road is better described by means of linearly distributed population, whose density is connected to the road traffic. In order to allow the description of changes in population density, in this way taking into account its dependence on time, the year and the day may be subdivided in more periods (for example seasons, day time-night time). For each period characterised by a different population distribution the procedure evaluates accident occurrence frequencies and people involved in each scenario.
IDENTIFICATION AND EVALUATION OF POSSIBLE ACCIDENTS The identification of possible accidental scenarios due to a material release is related to the conveyed dangerous substances and the means of transport. It is worth noticing that the identification of possible accidental scenarios is completely independent from population distribution, and consequently can be performed taking into account the design characteristics of the tanker or pipeline and the properties of the conveyed dangerous substance. Typical accidental release cases for road or pipelines transport of toxic, flammable substances may be identified and the characterisation of their accidental scenarios - regarding likelihood and size of breakage; rate, physical aspect and duration of the release;- may be carried out by using engineering judgement, literature information and proper simulation models. Consequences models enable to calculate the spatial distribution of the physical effects (toxic gas concentration, thermal radiation and blast overpressure) in the impact area, under the assumption of typical weather conditions. Lastly probit models allow to translate physical effects into vulnerability maps. Owing to the independence from population distribution, the vulnerability maps, i.e. the description of accidental scenarios and related likelihood of occurrence, can be stored and then utilised to evaluated the number of persons involved in each accident.
Advances in Safety and Reliability: ESREL '97
727
Pipelines accidents In a risk analysis typical pipeline accidents are described as provoked by breakages of different sizes: the engineering judgement, supported by historical searches, leads the analyst to choose which and how many classes of ruptures must be considered (usually a small hole, a medium one and the guillotine breakage are assumed). To describe a pipeline accident the frequency of occurrence of a given release per unit length (releases year-1 km-1)fof the pipeline must be evaluated. The parameterffor the pipeline can be derived by: f
=
2e p . Pl Pw xe
(1)
where 2p is the average release frequency (release year "l km-1),Po is the probability the release belongs to a certain rupture class, Pt is the ignition probability (for flammable substances only), Pw is the probability of a given wind direction (in a sector of 1o) and meteorological situation for the accidental scenario and xe is fraction of the time partitioning during which the pipeline is active. Pipeline incident data involving unintentional release of the pipeline content have been collected over the last decades by all major gas or oil transmission system operators both in Western Europe and in North America. This data form an extensive database from which the pipeline incident frequencies can be deduced. The incidents are classified according to the initial cause, which can be an external interference, corrosion, a construction defect or material failure and a natural hazard. Pipeline release frequencies mainly depend on the wall thickness, the diameter, the depth at which the pipe is buried, the year of construction (modem pipelines are safer than older ones because of improved construction standards and the rigorous material testing). Our calculations refer to an ammonia pipeline whose features are summarised in table 1:
:
TABLE1
Diameter Wall thickness Earth cover Year of construction Design flow Isolation valve spacing
203 mm 11.1 mm 1.5 m 1990 10.4 kg/s 10km
The release frequencies for such a pipeline have been taken from EGIG 1993; different values are given for a pinhole, a medium size hole and the guillotine break. These release frequencies and the diameters chosen to represent the pinhole and the medium size hole are presented in table 2:
TABLE 2 HOLE TYPE Pinhole Medium hole Guillotine break
RELEASE FREQUENCY [2p*p~] (ev/(km*y) 1.7 E-4 1.7 E-4 0.6 E-4
HOLE SIZE (mm) 20 100 /
E Leonelli et al.
728
Tanker accidents For road transport the frequency of occurrence per unit length (releases year "1 km -1) f o f a tanker release is evaluated resorting to the following equation:
f = 2R Prel P~ Pl PW nv Xv (2) where 2 n is the average incident rate (incidents vehicle -1 km-l), P,-et is the probability to have a release once an incident has occurred and the term nvx v represents the number of travelling tankers in each time partitioning. The tanker incident rate 2,R depends on the road type (i.e. motor ways, main roads, urban roads) and the traffic load, while Prel and p¢~ depend on the tanker features (for example the wall thickness). In our calculations data inferred from HSE 1991 were used, both for the release frequencies and the breakage sizes. These data are shown in table 3:
TABLE 3 RUPTURE CLASS
RELEASE FREQUENCY
HOLE SIZE
Small hole Medium hole Catastrophic rupture
[2"R*Prel*P~] 7 E-10 ev/(km*vehicle) 4.3 E-10 ev/(km*vehicle) 0.48 E-10 ev/(km*vehicle)
25 mm 50 mm /
The number of tankers travelling on the road was chosen to arrange the road delivery capacity to be the same that the pipeline capacity (the tanker tonnage is assumed to be 20000 kg).
Vulnerability maps In the numerical procedure a scenario is represented by a vulnerability distribution on a ~/rl Cartesian reference frame, whose origin is the point where release occurs, ~ being the downwind direction (Fig. 1). Its vulnerability data are stored in a matrix which represents the distribution, calculated once and for all, on a non uniform grid in the ~/rl plane. The ~/rl Cartesian axes can be rotated and translated on the area of interest in order to describe both the changes in the wind direction and the position where accidents occur along the tanker route or pipeline.
Figure 1: vulnerability map
SOCIETAL RISK ALGORITHM Once frequencies of occurrence are evaluated, the number of fatalities N for each scenario is calculated, by recalling vulnerability values stored for a point risk source, for each accidental scenario located in a generic point of the route. In order to evaluate the number of fatalities N due to a scenario, equation 3 is utilised:
Advances in Safety and Reliability: ESREL '97 n/
(3)
n.4
N-ZP,, IVp[Xt,+(1--Xz,)a,"]dl'+ZPA,IAVp[XA,+(1 i
i
729
/A,)ae]dA,+
'
nc
i
where n 1, n A and n C are respectively the numbers of lines, rectangles and point on the population map, 1 and A are the corresponding people density, x 1, x A and x C the fraction of people staying indoor. In equation 3 Vp is the vulnerability stored in vulnerability maps and p the mitigation factor deriving from being indoors. In order to evaluate the vulnerability Vp to perform the integration steps the vulnerability matrix is linearly interpolated obtaining a continue function. Equation 3 can be solved by locating the origin of /1"1Cartesian frame on the release point, and orienting /rl plane taking into account wind direction, overlapping in this way vulnerability and population map. An efficient numerical algorithm based on circuitation theorem has been developed in order to accelerate the surface integration of equation 3 that constitutes the slowest step. Once each scenario of the point risk source is characterised by a number of fatalities N and a frequency per unit lengthf frequencies for all scenarios involving a specific user-defined range of fatalities are added up to evaluate The procedure performs the line integration values along the linear risk source in order to obtain F/N curves (Leonelli, Spadoni 1996).
fN.
offN
UNCERTAINTY EVALUATION In order to better evaluate the impact on population of dangerous goods transportation the effect of the uncertainties of the input data on final results should be quantified. Fuzzy logic is a mean for quantifying uncertainties, which, compared with other more traditional techniques (for example the Monte Carlo method), has the advantage of a limited number of model calculations. Using fuzzy logic (Quelch, Cameron 1994) it is possible to represent a parameter A by a membership function A, which has values in the interval [0,1 ]; this function can be viewed as a possibility distribution as opposed to a probability distribution, since the sum of the grades of membership of a fuzzy number is not required to equal 1 and it is possible for more than one member to have a grade of membership equal to 1. In a QRA applied to transport of hazardous materials an important parameter, always affected by uncertainty, is the frequency of occurrence per unit lengthfof the linear risk source. Suppose to ask to some risk analysts to choose a release frequency for a given pipeline: imagine the majority of them say that f h a s values between 6E-4 and 7E-4 rel km -1 y-l, other two smaller parties say that acceptable values for f are respectively 4.5e-4 and 9E-4, and only few of them say thatfis smaller than 4.5E-4 or greater than 9E-4, while no one chooses values below 3E-4 or upon 1E-3. Applying fuzzy logic t o f we can say that f i s 0 for f > 1E-3 orf
![Reliability, maintainability and risk practical methods for engineers; [including reliability centred maintenance and safety-related systems]](https://epdf.pub/img/300x300/reliability-maintainability-and-risk-practical-met_5a4abcfcb7d7bc23216578e9.jpg)
