Part 2 – Lecture 4

Event Tree Analysis

Dr. Arshad Ahmad

Email: [email protected]

www.utm.my innovative ● entrepreneurial ● global

 Event Tree Analysis
§  Event tree analysis is a binary form of a decision tree for
evaluating the various multiple decision paths in a given
problem
§  It evolved from studies involving nuclear power plant in the
1970’s.

www.utm.my innovative ● entrepreneurial ● global 2

 Consequence Spectrum
§  An accidental event is defined as the first significant deviation from a
normal situation that may lead to unwanted consequences (e.g., gas
leak, falling object, start of fire)
§  An accidental event may lead to many different consequences. The
potential consequences may be illustrated by a consequence
spectrum

C1

C2
Accidental
Event

Cn

www.utm.my innovative ● entrepreneurial ● global

 Event Tree Analysis
§  An event tree is a visual representation of all the events
which can occur in a system.
§  The goal of an event tree is to determine the probability
of an event based on the outcomes of each event in the
chronological sequence of events leading up to it.
§  As the number of events increases, the picture fans out
like the branches of a tree.
§  By analyzing all possible outcomes, you can determine
the percentage of outcomes which lead to the desired
result.

www.utm.my innovative ● entrepreneurial ● global

 Generic Example

www.utm.my innovative ● entrepreneurial ● global

 Example: Fire

This event tree was constructed to analyze the possible outcomes of a system
fire. The system has 2 components designed to handle this event: a sprinkler
system and an automated call to the fire department. If the fire department is
not notified, the fire will be mostly contained by the sprinkler system. If the
sprinkler system fails as well, the system will be destroyed.

www.utm.my innovative ● entrepreneurial ● global

 Example: Explosion

www.utm.my innovative ● entrepreneurial ● global

 Constructing an Event Tree
§  Before constructing an ET, the cause and consequence
must be identified
§  When there is a hazardous initiating event, a Failure
(Consequence), may occur due to:
•  Failure of protective barrier
•  Other Factors, e.g.,
•  Whether a gas release is ignited or not
•  Whether or not there are people present when the accidental event
occurs
•  Wind direction when the accidental event

www.utm.my innovative ● entrepreneurial ● global

 Steps in Constructing Event Tree
1.  Identify (and define) a relevant accidental (initial) event
that may give rise to unwanted consequences
2.  Identify the barriers that are designed to deal with the
accidental event
3.  Construct the event tree
4.  Describe the (potential) resulting accident sequences
5.  Determine the frequency of the accidental event and
the (conditional) probabilities of the branches in the
event tree
6.  Calculate the probabilities/frequencies for the identified
consequences (outcomes)
7.  Compile and present the results from the analysis

www.utm.my innovative ● entrepreneurial ● global

 Accidental Event
§  When defining an accident event, we should answer the
following questions:
•  What type of event is it? (e.g., leak, fire)
•  Where does the event take place? (e.g., in the control room)
•  When does the event occur? (e.g., during normal operation,
during maintenance)

§  In practical applications there are sometimes

discussions about what should be considered an
accidental event (e.g., should we start with a gas leak,
the resulting fire or an explosion). Whenever feasible, we
should always start with the first significant deviation
that may lead to unwanted consequences.

www.utm.my innovative ● entrepreneurial ● global

 Accidental Event
§  An accidental event may be caused by:
•  System or equipment failure
•  Human error
•  Process upset
§  The accidental event is normally “anticipated”. The
system designers have put in barriers that are designed
to respond to the event by terminating the accident
sequence or by mitigating the consequences of the
accident.
§  For each accidental event we should identify:
•  The potential accident progression(s)
•  System dependencies
•  Conditional system responses

www.utm.my innovative ● entrepreneurial ● global

 Barriers
§  Most well designed systems have one or more barriers
to stop or reduce the consequences of potential
accidental events.
§  Barriers may be technical and/or administrative
(organizational).
§  The barriers that are relevant for a specific accidental
event should be listed in the sequence they will be
activated.
§  Examples include:
•  Automatic detection systems (e.g., fire detection)
•  Automatic safety systems (e.g., fire extinguishing)
•  Alarms warning personnel/operators
•  Procedures and operator actions
•  Mitigating barriers
www.utm.my innovative ● entrepreneurial ● global
 Additional Events/Factors
§  Additional events and/or factors should be listed
together with the barriers, as far as possible in the
sequence when they may take place.
§  Some examples of additional events/factors were given
on a previous slide

www.utm.my innovative ● entrepreneurial ● global

 Event Sequence
§  Each barrier should be described by a (negative)
statement, e.g., “Barrier X does not function” (This means
that barrier X is not able to performs its required
function(s) when the specified accidental event occurs in
the specified context).
§  Additional events and factors should also be described by
(worst case) statements, e.g., gas is ignited, wind blows
toward dwelling area.
Additional Barrier I Barrier II Barrier III Additional Outcome /
Accidenta
Accidenta does not does not does not Accidenta Consequenc
l Event
l Event function function function l Event e

True
By this way the most severe consequences
will come first
False

www.utm.my innovative ● entrepreneurial ● global

 Outcome Alternatives
§  In most applications only two alternatives (“true” and
“false”) are considered. It is, however, possible to have
three or more alternatives, as shown in the example
below:

Wind toward residential area

Gas Release Wind toward Factory

Wind toward empty area

www.utm.my innovative ● entrepreneurial ● global

 End Outcomes
§  In practice, many event trees are ended before the
“final” consequences are reached
§  Including these “final” consequences may give very
large event trees that are impractical for visualization
§  This is solved by establishing a consequence
distribution for each end event and the probability of
each consequence is determined for each end event
§  In effect, this is an extension of the event tree, but it
gives a more elegant and simpler presentation and also
eases the summary of the end results

www.utm.my innovative ● entrepreneurial ● global

 Results in Decision Making
§  The results from the event tree analysis may be used to:
•  Judge the acceptability of the system
•  Identify improvement opportunities
•  Make recommendations for improvements
•  Justify allocation of resources for improvements

www.utm.my innovative ● entrepreneurial ● global

 End Events

Out- Environmental
Freq- Loss of Lives Material Damage
come Damage
uency
descr. 0 1-5 >5 N L M H N L M H

www.utm.my innovative ● entrepreneurial ● global

 Frequencies of Outcome
Let λ denote the frequency of the accidental (initiating) event.
Let Pr(Bi) denote the probability of event B(i).

When we know that the accidental event has occurred, the

probability of “Outcome 1” is:

Pr(Outcome 1 Accidental Event) = Pr(B1 ∩ B2 ∩ B3 ∩ B4 )

= Pr(B1).Pr(B2 B1).Pr(B3 B1 ∩ B2 ).Pr(B4 B1 ∩ B2 ∩ B3 )

Note that all the probabilities are conditional given the result of the
process until “barrier” i is reached. The frequency of “Outcome 1” is:

λ • Pr( B1 ∩ B2 ∩ B3 ∩ B4 )
The frequencies of the other outcomes are determined in a similar
way.

www.utm.my innovative ● entrepreneurial ● global

Pipeline Leak Event Tree

www.utm.my innovative ● entrepreneurial ● global

 Gas pipeline Rupture Event

Check for error

www.utm.my innovative ● entrepreneurial ● global

 Pros and Cons of ETA
§  Positive
•  Visualize event chains following an accidental event
•  Visualize barriers and sequence of activation
•  Good basis for evaluating the need
§  Negative
•  No standard for the graphical representation of the event tree
•  Only one initiating event can be studied in each analysis
•  Easy to overlook subtle system dependencies
•  Not well suited for handling common cause failures in the
quantitative analyses
•  The event tree does not show acts of omission

www.utm.my innovative ● entrepreneurial ● global

 END OF LECTURE

www.utm.my innovative ● entrepreneurial ● global