Kristiansen Svein. Maritime Transportation: Safety Management and Risk Analysis

Подождите немного. Документ загружается.

MOCUS step 3.4 – for the event of ‘starboard main engine failure’ (i.e. E6 in the fault tree;

see Figures 8.12 and 8.13):

MOCUS step 3.5 – for the event of ‘port main engine failure’ (i.e. E7 in the fault tree;

see Figures 8.12 and 8.13):

236 CHAPTER 8 RISK ANALYSIS TECH NIQ UES

MOCUS step 4:

There are 19 possible combinations of basic causes (or basic event failures) for the

propulsion system (each row). There are mostly two basic causes in each cut set. It is

advantageous to have as many basic causes in each cut set as possible, and one and tw o

basic causes in each cut set is not much. The cut sets K

and K

include only one basic

cause. Hence the top event is triggered when one of these basic causes occurs. It would

therefore be advantageous to implement redundancy or other reliability improving

measures for these cut sets. For example, would the use of two independent propeller

systems create redundancy and hence reduce the risk for top event occurrence? This may,

however, not be practicable.

Q uantitative approach: fault tree calculations

There are severa l interesting calculations that should be performed. The probability of

the top event Q

is certainly of particular interest. The probabilities for each cut sets are

also of interest. Normally some computerized calculation program, such as a spreadsheet,

would be applied to calculate the top event probability. Here, on the other hand, the

events are calculated manually using the series and parallel structure equations presented

in Section 8.3 of this chapter. The series structure equation is used to calculate OR gates

and the parallel structure is used to calculate AND gates (it must be remembered that

the reliability p

¼1–q

, where q

is the failure probability). Failure data are given in

Table 8.13.

As shown in Table 8.14, the probability for the top event of ‘loss of main propulsion

function for a specified tanker under one year of normal operation’ is 0.465. This means

that there is a 46.5% chance that this particular unwanted, and potentially very

dangerous, event will occur.

Quantitative approach: assessment of basic cause importance

To assess the importance of the different basic causes, the cut sets’ failure probability is

calculated as in Table 8.15, using the given failure probability data in Table 8.13.

According to the Vessley-Fussell measure of component importance, the importance

ranking of the basic causes (or failures) is established as shown in Table 8.16. The ranking

of the components is the ‘repairman’s’ ranking. If propulsion is lost, the most likely failure

Ta b l e 8 . 14 . Calculation of top event failure probability Q

¼1 P

¼1 [ p

p

] ¼1 [(1 q

) (1 q

)] 0.301

1 [(1 q

) (1 q

)] 0.301

1 [(1 Q

) (1 q

)] 0.337

1 [(1 Q

) (1 q

)] 0.337

¼1 P

¼1 [1 (1 P

) (1 P

)] ¼Q

Q

0.114

0.187

1 [(1 q

) (1 q

)] 0.258

1 [(1 Q

) (1 Q

)] 0.465

8.7 FAULT TREE ANALY S IS ( FTA) 237

is related to the gear, i.e. basic cause/failure event F5, and so on. Other measures of

importance should be applied at the design stage.

8.8 EVENT TREE ANALYSIS (ETA)

In the fault tree analysis (FTA) section the probability for loss of the pro pulsion function

on a tanker was estimated. The possible consequences that may result because of the lost

propulsion function, however, have not been analysed so far. If the consequences of an

event or incident are to be analysed, a so-called event tree analysis (ETA) approach may

be applied. The event tree splits up a given initiating event forwardly and is therefore an

inductive method.

Ta b l e 8 .1 5 . Calculation of cut sets’ failure probabilities

¼0.236

¼0.029

¼0.073

¼0.0073

¼0.0043

¼0.014

¼0.0073

¼0.00073

¼0.00043

K10

¼0.0014

K11

¼0.0043

K12

¼0.00043

K13

¼0.00026

K14

¼0.00083

K15

¼0.014

K16

¼0.0014

K17

¼0.00083

K18

¼0.056

K19

¼0.187

238 CHAPTER 8 RISK ANALYSIS TECH NIQ UES

8.8.1 Principle

An ETA is a logical diagram based on chains of possible events. The logical diagram used

in an ETA descri bes the relation between an initiating event and the events that describe

the possible consequences. The basic principle of the ETA approach is that each level in

the chain of events leading to a consequence consists of two mutually exclusive dichotomy

events. Two events are, by definition, mutually exclusive (or disjoint) if it is impossible

for them to occur together at the same time. Dichotomy means that an event can only

have two different outcomes. For example, the event of a tanker c ollision may have two

possible outcomes with respect to the oil cargo tanks: non-rupture of the cargo tanks

or the rupture of these tanks, the latter resulting in oil pollution an d possibly also a fire.

Based on this it is clear that ETA is a binary technique. An initiating event may develop

into several consequences both in type and magnitude/severity. The likelihood of one

event is dependent on the previous events, as well as the nature of the event. This

dependency is discussed in more detail later.

8.8.2 Approach

ETA is a quantitative method for the estimation of consequence probabilities based on a

given initiating event. Hence the first task of the approach is to define the initiat ing event,

which is the first in a sequence of events leading to a hazardous situation or accident. Next,

the safety systems, mechanisms and situation characteristics that function as barriers

in the consequence development process are established in a chronological order. The

probabilities for the outcomes of each dichotomy event (e.g. the success of a particular

safety barrier/mechanism) are then estimated and an initial event tree is established.

At this stage, however, the probability for each dichotomy event is independent of the

previous events. Two events are, by definition, independent if the occurrence of one event

does not give us any information about whether or not another event will occur, i.e. the

events have no influence on each other. In reality, on the other hand, the events may to

some degree be dependent on each other. As presented in Figure 8.14, these dependencies

can be related to the time, their location in the event chronology, and conditional

involvements of previous events. Some sort of correction for these dependencies should

Ta b l e 8 .1 6 . Importance ranking based on theVessley-Fussell measure of importance

Relevant cut sets 1 (1 Q

) I

Ranking

F1 K

0.0966 0.208 3

F2 K

0.0098 0.021 6

F3 K

0.0061 0.013 7

F4 K

0.071 0.150 4

F5 K

0.236 0.507 1

F6 K

0.029 0.062 5

F7 K

0.187 0.402 2

8.8 EVENT TREE ANALYS IS (ETA) 239

be performed. It is not, however, possible to establish a general procedure for such

corrections.

8.8.3 Elements

In order to perform a realistic and acceptable ETA the analyst(s) must have sufficient

system knowledge and understanding. In addition, common sense, as well as logical

and creative thinking, are important resources in the process of performing an event tree

analysis. The design of the event tree diagram is done using the following approach.

The events are arranged in ch ronological order with the initiating event on the top,

followed by important and relevant intermediate events and the consequence events placed

at the bottom. The binary dichotomy event occurrence is visualized in the event tree

by placing the unwanted event (i.e. failure) to the right and the successful/desired event

to the left.

Exam p le

Problem

The loss of propulsion power resul ts in loss of controlled mobility for an oil tanker.

The event of loss of propulsion power has been exami ned earlier in this chapter using the

Figure 8.14. Event tree analysis approach.

24 0 CHAPTER 8 RISK ANALYSIS TECH NIQ UES

fault tree analysis (FTA) approach. The potential consequences for the loss of

propulsion power have not, however, been analysed in detail. Because the oil tanker

has large oil spill potential, with devastating effects on the environment, it is of great

interest to estimate the likelihood of an oil spill if propulsion function is lost. Such

information can, for example, be used to evaluate whether additional safety measures

should be implemented to reduce the probability for such accidents. For the given

system description in Figure 8.15, find the likelihood of oil spill when the propulsion

function is lost.

Solution

Assumption:

The loss of propulsion power has a probability of 0.465 per year.

Analysis:

The initial event tree shown in Figure 8.16 is designed. In this initial event tree, possible

dependencies between the events have not been assessed. This assessment process is,

however, far from easy and is normally carried out at the discretion of the analyst. The

problems involved in assessing dependencies between events exist for all quantified

methodologies. The dependencies between the events in the initial event tree are assessed in

the influence diagram in Figure 8.17. For example, it is found that the ‘critical impact

forces’ event and the ‘emergency anchoring failure’ event are both dependent on the

‘critical weather force’ event. The ‘critical weather force’ event may, on the other hand,

be dependent on the ‘critical drifting direction’ event.

Figure 8.15. System description.

8.8 EVENT TREE ANALYS IS (ETA) 241

Based on the influence diagram, an asses sment of the probabilities is performed

at the discretion of the analyst, and the event diagram shown in Figure 8.18 can then be

established. The consequence probabilities are calculated by finding the prod uct of all the

events leading to the consequence, including the probability of the initiating top event in

the event tree.

Figure 8.16. Initial event tree diagram.

Figure 8.17. Influence diagram for assessing event dependencies.

242 CHAPTER 8 RISK ANALYS IS TECHN IQU ES

As can be seen from the event tree in Figure 8.18, the likelihood/probability of oil

spill initiated by the loss of propulsion power, and caused by a critical stranding, is

0.048 per year of operation.

Figure 8.18. Final event tree diagram with some consequence probabilities calculated.

8.8 EVENT TREE ANALYS IS (ETA) 243

REFERENCES AND SUGGESTED READI NG

Dahle, E. A., 1976, Forelesningsreferat Pa

litlighetsteknikk for fag 80559, 80560, 80525. Norwegian

University of Science and Technology, Faculty for Marine Technology, Division of Marine

Design.

DNV Technica, 1996, Safety Assessment of Passenger/Ro-Ro Vessels – Methodology Report for the

Joint Nordic Project on Safety of Passenger/Ro-Ro Vessels. DNV Technica, London.

Harms-Ringdahl, L., 1993, Safety Analysis: Principles and Practice in Occupational Safety. Elsevier

Science, Oxford, UK.

Henley, E. J. and Kumamoto, H., 1981, Reliability Engineering and Risk Assessment. Prentice-Hall,

Englewood Cliﬀs, NJ.

Høyland, A. and Marwin, R., 1994, System Reliability Theory. John Wiley, New York.

Kuo, C. et al., 1997, A Safety Case for Stena Line’s High Speed Ferry HS1500. Royal Institute of

Naval Architects, London.

Lambert, H. E., 1973, System Safety Analysis and Fault Tree Analysis. Lawrence Livermore

Laboratory, California.

244

COST-BENEFIT ANALYSIS

Matter will be damaged in direct proportion to its value.

(‘‘Murphy’s Constant’’)

9.1 INTRODUCTION

Cost-benefit analysis (CBA) is basically a technique for comparing the costs and benefits

of a project. The technique was originally developed to help appraise public sector projects

to ensure that one achieved the greatest possible value for money, but the concept of cost-

benefit analysis has now applications far beyond the public sector domain. In this chapter

we are particularly concerned with CBA in the context of risk and safety assessment.

The term safety can be defined as the extent to which a system is free from danger to

life, property and the environment. The concept of risk, which has the two components

of probability and consequence, is used to evaluate the significance of the danger resulting

from hazards, i.e. possible events and conditions that may result in severity. Reduced risk

of severe accidents means increased safety. No accident is ever acceptable, and attempts

should always be made to prevent them from occurring as well as to reduce the possible

consequences if they occur. Applying and implement ing safety measures can reduce the

risks of severe accidents and hence improve safety, but these measures also, unavoidably,

incur costs. At some point the cost of the implemented safety measures will make, for

example, a ship or an oil rig unecono mic to operate or uncompetitive in the relevant

market. As a result there must always be a trade-off between the costs of implementing

safety measures and the residual risk level, because no matter what measures are taken to

reduce the risks of accidents, some residual risk will remain. Risks can never be eliminated

altogether, and some level of risk will always have to be a ccepted. It is the safety regime,

the designer of the system and the system operator that must make this difficult cost-

benefit trade-off, a trade-off that in reality often, but not always, consists of establishing

economic criteria for acceptable risk level.

The concept of cost-benefit analysis is quite simple, and need not necessarily involve

fancy mathematical tools. Actually we all pe rform cost-benefit analyses on a daily basis,

for example when we are shopping for groceries. Most people decide on which items to

buy based on a trade-off between their perceived benefits and costs, such as quality, price,

personal preferences, etc. One should recognize that costs and benefits can be understood

in general terms and not just in monetary terms. The costs of buying a certain product of

245