624 5 Safety and Risk i n Engineering Design in an information integrated technology (IIT) program considered in Sect. 3.3.3.4 and illustr ated in Fig. 3.46. The beta factor model is extensively used in predictions, in which the appropri- ate values for beta are selected on the basis of expert engineering judgement. The problem with the model, though, is the lack of any detailed data for generic sys- tems, assemblies and components, to provide an adequate assessment of safety in engineering design—especially in the preliminary design phase. As a result, quite large beta factors have been applied without any justification, and caution needs to be exercised when selecting these beta values, otherwise the estimates will give un- justifiably pessimistic results with possible over-design of safety-related systems. A somewhat different approach to the beta factor model has thus been taken in which the beta values are not used but predictions are made directly from event data using expert judgment. This approach necessitates identifying the root causes of failure and the likelihood of generating simultaneous failures in similar equip- ment (Hughes 1987). Fundamentally, the basis of this approach, typical to IIT, is to represent the variability of a component failure probability by distributions that can be estimated directly from a relatively small d atabase. However, some researchers have pointed out the deficiencies of expert engineering judgement as applied to common cause failures, and contend that analysis of such failures is a knowledge- based decision process and, therefore, is itself subject to error or uncertainty (Do- erre 1987). b) Problems with Applying CCF in Safety and Risk Analysis for Engineering Design Problems with applying CCF in safety and risk analysis for engineering design as- sessment in the preliminary design phase can thus be reviewed. These problems are summarised as (Hanks 1998): • The lack of a suitable comprehensive database for CCF. • Use of simple CCF models giving pessimistic results for redundancy systems. • The assumption that similar components will be similarly affected. • Errors in understanding the nature of CCF and applying the appropriate method- ology. Various alternative models that refine the beta factor method have thus been pro- posed, such as a binomial failure rate model that assumes that a component has a constant independent failure rate and a susceptibility to common cause sho cks at a constant rate (NUREG/CF-1401 1980). This has been extended to include com- mon cause shocks that do not necessarily result in catastrophic failure. A practical method of common cause failure modelling modifies the beta factor model to take account of the levels o f redundancy and diversity in systems (Martin et al. 1987). It was previously noted that the simple b eta model is pessimistic when applied to redundancy systems. This can also be the case when it is applied to a range of sim- ilar components even if they are installed in one system. To illustrate this problem, 5.2 Theoretical Overview of Safety and Risk in Engineering Design 625 an example is given based on a simplified high-pressure protection redundancycon- figuration relating to the high-integrity protection sub-system (HIPS) illustrated in Fig. 5.22. As indicated in Sect. 5.2.3.2, the function of the HIPS sub-system is to prevent a high-pressure surge p assing through the process, thereby protecting the process equipment from exceeding its individual pressure ratings. A schematic of the simplified configuration is given in Fig. 5.23. In this example, a possible source of CCF is the contamination of the upstream high-pressure line. In theory, all the regulators should be equally affected—however, much depends upon the design features of the m ain valves and their control systems. Contamination of the h igh-pressure line will affect the active control valve,A 1 , in the operating stream. Whether it will affect the monitor valve M 1 , and to what extent, depends on the way the control system functions. Both the regulators in the standby stream should be unaffected. In this example, there is a potential for CCF to occur but normal practice would be to assume that CCF applies equally to all the four identical valves—so, it will be seen that the result of any prediction would be pessimistic. Another problem in this case would be the total misunderstanding of how to apply CCF prediction methodology. In Fig. 5.23, there are two control streams,one functioning as an operating stream with two identical regulators (pressure valves), M 1 and A 1 , and the other functioning as a standby stream with two identical regulators, M 2 and A 2 . Each stream’s regu- lator configuration consists of a monitor valve, M i , and an active control valve, A i (i = 1,2). The first regulator in the operating stream, the monitor valve M 1 , is fully open in readiness to take over control should the pressure rise above apredeter- mined level due to failure of the active control valve A 1 . The active control valve A 1 controls the outlet pressure. Similarly, the first regulator in the standby stream, M 2 , is fully open and will function in a similar manner as valve M 1 , should the standby stream be activated. The second regulator in the standby stream, A 2 ,isclosedand will take over pressure regulation if either of the regulators in the operating stream fails to reduce the outlet pressure to below a predetermined level. Common cause failures can arise from a wide range of potential problems, typ- ically identified through factor tree charts and associated questions concerning the potential root causes of design integrity problems (as indicated in Sect. 5.2.1.2, and Figs. 5.6 through to 5.8). Fig. 5. 23 Schematic of a sim- plified high-pressure protec- tion system 626 5 Safety and Risk in Engineering Design Table 5.13 A nalysis of valve data to determine CCF beta factor Valve type CCF beta factor Ball, plug and gate valves 0.01–0.02 Relief valves, all types 0.05 Check and non-return valves 0.05 Cut-off valves 0.05 Large r egulators/control valves 0.10–0.19 Small re gulators/control valves 0.05–0.12 Actuators, all types 0.05–0.16 Minimising the effects of CCF is thus an on-going process, already from the early phases of engineering design to the in-service life. Any attempt to cut corners or costs will almost inevitably expose engineered installations to a higher level of CCF-induced failures, with resulting increased costs of failure maintenance, lost production and possible loss of life. Design criteria databases do not usually include common cause failure data. One problem is that CCF data for a particular component can be specific to the application and, hence, require a whole series of design, operation and mainte- nance considerations for a particular process. Detailed analysis of valve data from a large database collected from maintenance and operational records has yielded useful information on the incidence of CCF (Hanks 1998). The data, summarised in Table 5 .13, cover a wide range of valve types and applications, including actua- tors. This quantification of the CCF beta value, indicating that a significant portion of the total failure rate of a component arises from common cause failures, has placed upper limit constraints on obtaining sufficiently high levels of reliability and safety in critical risk control circuits. As indicated previously, redundancy is one method in avoiding this problem, although the approach does lead to large increases in the false alarm rate (FAR). This is overcome, however, by utilising voting redundancy where several items are u sed in parallel and a selected amount are required to be in working order. The voting redundancy problem involves the simultaneous evaluation and selec- tion of available components and a system-level design configuration that collec- tively meets all design constraints and, at the same time, optim ises some objec- tive function, usually system safety, r e liability, o r cost. In practice, though, each of these parameters may not be exactly known and there is some element of risk that the constraint will not actually be met or the objective function value may not be achieved. 5.2 Theoretical Overview of Safety and Risk in Engineering Design 627 5.2.4 Theoretical Overview of Safety and Risk Evaluation in Detail Design Safety and risk evaluation determines safety risk an d criticality values for each in- dividual item of equipment at the lower systems levels of the systems breakdown structure (SBS). Safety and risk evaluation determines the causes and consequences of hazardous events that occur randomly, together with a determination of the fre- quencies with which these events occur over a specified period of time based on critical component failure rates. Safety and risk evaluation is considered in the de- tail design phase of the engineering design p rocess, and includes basic concepts of modelling such as: i. Point process event tree analysis in designing for safety. ii. Cause-consequence analysis for safety systems design. iii. Failure modes an d safety effects evaluation. 5.2.4.1 Point Process Event Tree Analysis in Designing for Safety The most extensive safety study to date is the US Nuclear Regulatory Commis- sion’s report “Reactor Safety Study” (NUREG-75/014 1975). In October 1975, the NRC issued the final results of a 3-year study of the risks from postulated accidents during the operation of nuclear power reactors of the type used in the USA. This re- port, known as the “Reactor Safety Study (RSS)”, or by its NRC document number, WASH 1400, was the first comprehensive study that attempted to quantify a variety of risks associated with power reactor accidents. Since that time, about 40 reactors have been analysed using the same general methodology as WASH 1400 but with considerably improved computer codes and data. The most recent and the most detailed of these studies has been the effort under- taken by the NRC to analyse five differentreactorsusing the very latest methodology and experience data available. In June 1989, the second draft of this work, “Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants” (NUREG 1150 1989), was issued for public comment. There is, however, widely h eld belief that the risks of severe nuclear accidents are small. This conclusion rests in part upon the probabilistic analysis used in these studies (NUREG/CR-0400 1978). The analysis used in these studies provides a suitable example in order to better understand the application of point process event tree analysis in the evaluation of safety and risk in the detail design phase. The approach to safety evaluation, as researched in these two studies, consider ed the sources of the risk, its magnitude, design requirements, and risk determination through probabilistic safety evaluation (PSE). These points of approach, although very specific to the example, need to be briefly explained (Rasmussen 1989). 628 5 Safety and Risk in Engineering Design a) Determining the Source of Risk During full power operation, a nuclear power reactor generates a large amount of ra- dioactivity. Most of this r adioactivity consists of fission products, resulting from the fission process, which are produced inside the reactor fuel. The fuelis uranium diox- ide, a ceramic material that melts at about 5,000 ◦ F. The fuel effectively contains the radioactive fission products unless it is heated to the melting point. At temperatures in this range, essentially all the gaseous forms of radioactivity will be released from the fuel. In addition, some of the more volatile forms of the solid fission products may be released as fine aerosols. If any of these forms were to be released into the atmosphere, they could be spread by prevailing winds. b) Designing for Safety Requirements Design requirements for safety in US nuclear plants mandate that the plants have systems to contain any radioactivity accidentally released from the fuel. The main system for accomplishing this is the containment building, an airtight structure that surrounds the reactor. In addition, all reactors have a system for removing aerosols from the containment atmosphere. In many reactors, this system consists of a wa- ter spray that can create the equivalent of a heavy rainstorm inside the contain- ment building. Boiling water reactors (BWR) accomplish this function by passing released gases through a pool of water. The principal goal of the reactor safety phi- losophy is to prevent the accidental release of radioactivity. As a backup, systems are added tha t prevent the release of rad ioactivity to the atmosphere even if it were released from the fuel. Despite these efforts, one can always postulate ways in which these systems might fail to prevent the accidental release of radioactivity. It is the task of probabilistic safety evaluation (PSE) to identify how this might happen, to determine how likely it is to happen and, finally, to determine the health effects and economic impacts of the radioactive releases upon the public. c) Probabilistic Safety Evaluation (PSE) • The first step in a PSE analysis begins by developing the causes and likelihood of heating the fuel to its melting point due to either external causes (earthquakes, floods, tornadoes, etc.) or internal causes. This analysis involves developing a logical relationship between the failures of plant components and operators, and the failure of system safety functions. The result of this analysis is an esti- mate of the probability of accidentally melting the fuel, a condition often called ‘core melt’. Of the plants analysed thus far, most have an estimated likelihood of core melt of between 1 in 10,000 and 1 in 100,000 per plant year. • The second step in a PSE analysis is to determine the type and amount of radioac- tivity that might be released in the d ifferent accidents identified. These fractions of the various types of radioactivity released are called the ‘source terms’ for 5.2 Theoretical Overview of Safety and Risk in Engineering Design 629 the accident. The values from WASH 1400 are in most cases significantly larger than those from NUREG 1150. The lower values of NUREG 1150 are the result of new information gained from m ajor research in the USA, Japan and Western Europe. These experiments, and the measurements at Three Mile Island confirm that the values used in WASH 1400 are too high. • The final step in a PSE analysis is to calculate the effects of any radioactivity re- leased in the accident. Sophisticated computer models have been developed to do this calculation. These models require input of the source terms, the population density around the site, and weather data for recent years from the plant site. The code then calculates thousands of cases to generate curves that give the magni- tude of given r isks versus their probabilities. The results of the calculations are in the form of fatality curves. The curves generally give the frequency in units per reactor year for events of a given size, and have a wide range of consequences, from quite small at high frequencies to quite large at very low frequencies. • Curves of this shape are typical of all accidents where a number of factors affect the magnitude of the event. In the case of catastrophic accidents, clearly this refers to accidents of low probability near the high-consequence end of the scale. These extreme accidents come about only if the various factors affecting the magnitude of the consequences are all in their worst states. Thus, for example, the core must melt, then the containment must fail above ground level, the wind must be blowing towards an area of relatively high population density, inversion conditions must prevail, and civil protectio n efforts must fail to be effective. Criticism of the Reactor Safety Study pointed to inadequacies in the statistical methodology, particularly the uncritical use of the log-normal distribution to derive probability estimates for the failure of individual nuclear safety systems (NUREG/ CR-0400 1978). There is an inherent weakness to the approach, in that there is no way of being sure that a critical initiating event has not been overlooked. The logic event tree consists of the initiating event and the success or failure response of each of the applicable engineered safety features. After identifying the accident sequence, the probability of occurrence of each engineered safety system in the sequence must be evaluated. As no empirical data are available on which to base estimates of sys- tem failure rates, it is necessary to use techniques that generate system failure rates from comparative estimates of failures of similar equipment. The extended use of event trees to derive probability estimates for both the failur e of individual n uclear safety systems, as well as the accident sequences was developed b y the US Depart- ment of Defense and the US National Aeronautics and Space Authority (NASA; NUREG 1150 1989). With the identification of potential accidents and the quantification of their probability and magn itude, accident sequences are identified by means of lo gic diagrams—in this case, logic event trees. The starting point for the development of these logic event trees is the identification of the event that initiates a potential accident (due to a catastrophic failure event) or potential incident (due to a criti- cal failure event). A typ ical initiating event for the nuclear reactor safety example would be a pipe break that results in a loss of coolant. Initiating events are usu- ally identified using technical information and engineering judgment, similar to an 630 5 Safety and Risk in Engineering Design Fig. 5.24 Typical logic event tree for nuclear reactor safety (NUREG-751014 1975) integrated information technology (IIT) program considered in Section 3.3.3.4 and in Fig. 3.41. Figure 5.24 shows a typical lo gic event tree with an initiating event of a pipe break in a nuclear reactor coolant lin e, with probab ility of occurrence of λ .The logic event tree is simplified in that only seven out of 2 4 possibilities need to be considered—for example, if electric power fails with an event rate of λ P 2 , then none of the engineering safety features will function. The output of the logic event tree is the release category consequences with th eir event rates. Since the probability of occurrence is small (i.e. equivalent to the concept of a rare event), the probabilities are approx imated by omitting all 1 −P i terms. d) Point Process Consequence Analysis The basic methodology of the Reactor Safety Study used an approach of determin- ing a demand failure rate. This can briefly be explained as the control of the rate of reaction in an atomic power plant by the insertion of control rods. The times at which control is needed is termed the transient demand, and was assumed to occur in an operating time equivalent to a Poisson process. When a transient demand oc- curs, the conditional probability that the safety system does not function, resulting in the consequence of an accident, was determined. Based on the Reactor Safety Study, a method for evaluating consequences as a result of safety system failure in a catastrophic-event process such as a nuclear reactor has been researched (Thomp- son 1988). Suppose the events initiating accident sequences (as in Fig. 5.24) occur in time according to a stochastic point process with an event rate of μ (t).Furthermore, let N(t) denote the number o f events up to time t,andT i (i = 1,2,3, ,k) denote 5.2 Theoretical Overview of Safety and Risk in Engineering Design 631 the time at which the ith initiating event occurs. Suppose further that the ith ini- tiating event yields the consequence C i . Assume that C i is a non-negative random variable with failure distribution function P(C i ≤ c)=F(c), and survival function P(C i ≥ c)=F (c). The consequences can be assumed to be identically distributed and independent of one another, with the understanding that there are several kinds of risks, each with its own initiating event rate and consequence distribution. Fi- nally, the evolution of consequences has been assumed to follow a point process. Actually, the consequences of many accidents and incidents are difficult to express numerically and most are vector valued in time. The basic methodology of the Re- actor Safety Study in dealing with this problem was to conduct a separate study for each type of consequence, and to present the risk in terms of an event rate against a consequence in the formof a risk curve, as illustrated in Fig. 5.25. In mathematical terms, if μ k (t) is the event rate at time t of consequences exceeding k, the critical number of consequences, then the risk curve is a graph for fixed t of μ k (t) versus k. The event rate of consequences that exceed k is related to the process of initiating events and the distribution of consequences μ k (t)=[1−F(k)] μ (t) (5.66) where: F(k) is the failure distribution function of C i . Fig. 5. 25 Risk curves from nuclear safety study (NUREG 1150 1989) Appendix VI WASH 1400: c.d.f. for early fatalities 632 5 Safety and Risk in Engineering Design Different process systems designs have different consequence sequences. The consequence sequences, S, of a particular process, P, over a time period, t, can be expressed as S P (t)= 0 N(t)=0 C 1 +C 2 +C 3 + C N(t) N(t) > 0 (5.67) Characteristics of S P (t) are determined by N(t) and the distribution of the con- sequences C i , where the sequence of c onsequences constitutes a point process. Of specific interest is to determine the catastrophic event having the greatest conse- quence when one accident is too much in the sequence of consequences. This is done by defining an expression for S P in the catastrophic case S P (t)= 0 N(t)=0 max[C 1 +C 2 +C 3 + C N(t) ] N(t) > 0 (5.68) Probability S P (t) being less than k, the critical number of consequences is given by P(S P (t) ≤ k)=P (5.69) where: P = ∞ ∑ n=0 P[C i ≤ k; i = 1,2,3, ,n|N(t)=n] If C i is a non-negative random variable with the failure distribution function P(C i ≤ c)=F(c),then P(S P (t) ≤ k)= ∞ ∑ n=0 [F(k)] n ·P[N(t)=n] (5.70) = ψ t [F(k)] (5.71) where: ψ t = probability generating function of N(t) (i.e. Bernoulli transform) and if C i is a non-negative random variable with the survival function P(C i ≥ c)= F (c),then P(S P (t) > k)=1− ψ t [F(k)] ≤[1−F(k) ·EN(t)] (5.72) Thus, for consequences exceeding k, the critical number o f consequences (or the ‘cut-off value’ between acceptable and un acceptable consequ ences), the prob a bility of the occurrence of an unacceptable consequence within time t will be less than F (k)EN(t),whereF (k) is the survival function P(C i > k),andEN(t) is the ex- pected value or mean of N(t), the number of events on (0,t]. If system failure is now identified with obtaining an unacceptable consequence, then F (k) is the demand failure rate (such as the demand to control the rate of reac- tion in an atomic power plant by the insertion of c ontrol rods). This demand failure rate yields an upper bound for the probability of failure. Since k is the unaccept- able critical number of consequences, the probability of a consequence exceeding 5.2 Theoretical Overview of Safety and Risk in Engineering Design 633 that value must be as small as possible—that is, F (k) will be near 0 with an upper bound when F(k) is near 1. The expected maximum consequence can be expressed as EC (t)= ∞ 0 {1− ψ t [F(k)]}dk (5.73) EC (t)= ∞ ∑ n=0 ∞ 0 {1−[F(k)] n }dk ·P[N(t)=n] (5.74) From Eqs. (5.72) and (5.74) we get: EC(t)·P[N(t) ≥ 1] ≤ EC (t) ≤ EC(t)·N(t) where: EC(t)=the expected value of consequence C in period t EC (t)=the expected value of consequence C in period t P[N(t) ≥ 1]=the probability that the number of events ≥ 1. The expected time to the first critical event with unacceptable consequence is given as EV k = ∞ 0 ψ t [F(k)]dt (5.75) EV k = ∞ ∑ n=1 ET n [F(k)] n [1−F(k)] (5.76) where: T n = timeofoccurrenceofthenth initiating event. The probability generating function (p.g.f.), or Bernoulli transform ψ t , needs to be defined in greater detail: Thus, given a random variable N(t), its generating func- tion ψ t (z) is expressed as ψ t (z)= ∞ ∑ n=1 z n P[N(t)=n] (5.77) ψ t (z)=Ez N(t) (5.78) ψ t (z) is a function in terms of z with the following properties: • The p.g.f. is determined by and also determinesC • ψ t (1) is the expectation of N(t) • ψ t (1) is the expectation of N(t) ·[N(t)−1]. Probability generating functions also provide for addition of independent ran- dom variables. For example, if N(t) and C(t) are independent, then the p.g.f. of . uncertainty (Do- erre 1987). b) Problems with Applying CCF in Safety and Risk Analysis for Engineering Design Problems with applying CCF in safety and risk analysis for engineering design as- sessment. considered in the de- tail design phase of the engineering design p rocess, and includes basic concepts of modelling such as: i. Point process event tree analysis in designing for safety. ii. Cause-consequence. Theoretical Overview of Safety and Risk in Engineering Design 627 5.2.4 Theoretical Overview of Safety and Risk Evaluation in Detail Design Safety and risk evaluation determines safety risk an d