-----------------------
Energy Trace Barrier Analysis (ETBA) – Qualitative analysis technique used to identify hazards by tracing energy flow into, thru, & out of a system. “Energy hazard” is defind as an energy source tht adversely impacts an unprotectd or vulnerable target. Assessment is conductd by following the energy path to determine if adequate controls are in place to assure undesird energy release does not occur.– Energy flow is tracd through the system operation & energy transfer points are identifid– Barriers to ento energy flow are evaluatd to determine adequacy • ETBA process can be applied at any stage of the project lifecycle & can be very useful for:– Systems design –Developing procedures(e.g., lockout--‐tagout). – Planning/judging operational readiness. – During mishap investigation or making “safe--‐to--‐enter” decisions at mishap sites. ETBA Approach • Examine system & identify all energy sources • For each energy source, trace its path through the system • Identify all targets tht could be vulnerable to the energy source • Identify all barriers in the energy flow path • Determine if existing controls are adequate. Energy Source– any material, mechanism, or process tht contains potential energy tht can be releasd •Electrical •Mechanical •Chemical •Radiation• Sonic• Thermal• Nuclear• Pneumatic• Hydraulic• Others
Energy barrier --‐ any design or administrative method tht prevents energy from being releasd or prevents a hazardous energy source from reaching a vulnerable target in sufficient magnitude to cause damage or injury • Walls guardrails • Insulation • Toe boards• Shielding• Hard hats• Barricades • Procedures • Lockout/Tagout • Others Target(s)– Personnel– Equipment– Product– Productivity– Environment– Reputation– Others. Note: Unwantd energy release from a single Source may attack multiple Targets. Strategies for Managing Harmful Energy Flow: • Exclude energy concentration • Limit quantity &/or level of energy • Prevent energy release • Modify rate of release of energy • Separate energy from target in time &/or space • Isolate by interposing a material barrier • Modify target contact surface or basic structure •Strengthen potential target • Control improper energy input

Fault Tree Analysis * Reliability & System System *graphic display of chains of events/ conditions leading to the loss event *used to understand the logic leading to the TE *best applied to cases w/large, perceivd threats of loss, i.e. high risk *Primary (basic) Failure – a fault of a cmpnent that occurs in normal operating & environmental conditions for which the cmpnent is qualifid. Ex. Fatigue failure of a relay spring witin its ratd lifetime; pressure tank that ruptures at normal operating pressure due to a defective weld. Secondary – outside normal operating conditions or in an environ. For which it has not been qualifid. Ex. Pressure tank that ruptures when an over – pressure relief valve fails & tank pressure exceeds the ratd capability. Ground Rule I: Write the statement in event boxes as faults; state precisely what the fault is & when it occurs. Ground Rule II: Can this fault consist of a cmpnent failure? Yes. State cmpnent fault. Add OR-gate below the event & look for primary, secondary, & command faults. No. State of system fault. Look for minimum necessary & sufficient immediate causes. NO MIRACLES. COMPLETE THE GATE. NO GATE-TO-GATE. Ik = Pk / PT. Structural Importance: low (& high) # of events in a cut set indicates high (& low)safety vulnerability, cut set w/a single initiator indicates a potential single point failure, if there is a large total # of cut sets the collective risk needs to be evaluatd to determine whether the combind risk of the TE is unacceptable. Path Sets-> switch all & gates to OR gates, vice versa.A group of fault tree initiator which, if none of them occurs, will ensure that TE can’t occur. USED TO transform a Fault Tree into a Reliability Block Diagram. AIDS TO further diagnostic measures, linking to success domain, trade studies. Minimal Cut Sets are the smallest number of fault tree initiators that will produce the Top Event if all the initiators in the group occur. Path Sets are the smallest # of fault tree initiators which, if theycan’t occur, ensures the TE can’t occur.

Cause-Consequence Analysis, bottom-up, deductive • It symbolic logic trees similar to fault trees • It explores system responses to an initiating “challenge” or scenarios that affect the system. – Resulting sequence of events is determined – Interrelationships between consequences and their causes is graphically displayed • Enables assessment of many possible outcomes from a single initiating event • Prob of each undesired outcome can be obtained. “CAUSE” Portion is a system challenge which… – may represent a desired (success--‐related) or an undesired (failure--‐ related) event/condition. • Ex. “Challenges” include: – Normal System Operating Command – Toxic Chemical Spill – Utility System Failure. “CONSEQUENCE” portion portrays an array of outcomes– representing staged increments of success/failure. – wit each increment having an associated level of prob.

Accident Investigation. Direct relationship btwn hazards & accidents. –Accident is the event & associated outcome tht results frm an actualized haz. Near miss is the occurrence of an unplanned event tht did nt result in injury, illness, or damage, but had the potential to do so. Investigation of “near misses” is extremely important. Near miss reportin & investigation facilitates identifyin & controllin hazards before they lead to a more serious incident. Purpose : Determine the sequences of events leadin to failure. •Identify the cause(s) of the accident. •Find methods to prevent accident frm recurrin. •The primary purpose of an accident investigation is NT to establish blame. Accident Investigation Plannin •Organizations shud have an established policy outlinin response to an accident includin: –Notification process •Include outside agencies (e.g., OSHA) –Who will be involved in accident investigations •Establish trainin for personnel appointed as board chairmen –Requirements for accident reports & distribution. Major Fed Accident Investigation Boards •National Transpo Safety Board (NTSB) •Chemical Safety Board (CSB). (OSHA). (US NRC). (NHSTA ). (FRA). Responsibilities: •Determine the sequence of events leadin to the accident •Determine the proximate causes, root causes, & contributin factors •Develop recs for preventin a recurrence of an accident –Address nt only the specific accident bein investigated but also future similar accidents •Address other safety concerns discovered durin the investigation. 5 Phases: –Preparin for the investigation –Gatherin evidence & info –Analyzin data –Discussion of the analysis & conclusions –Recs. Analyzin Data. all sources of evidence “4 P’s” –Physical evidence - tools, equipment, spills, leaks, debris –Paper evidence – operatin & maintenance procedures, trainin records, personnel records –Ppl evidence – statements frm witnesses & first responders –Picture evidence – photos, videos, &diagrams Recs shud include: –What immediate actions shud be taken to prevent future accidents –What resources are needed –Who is responsible for the changes –Who will follow-up & ensure changes are implementd •Remember to ensure tht changes are evaluated to determine whether new hazs are introduced or current hazard control are invalidated –Long-term recs for haz reduction

Probablistic Assessment Risk -•A systematic & comprehensive method to identify & analyze risks throughout the lifecycle of a system •PRA attempts to quantify probabilities of rare events (failures) by taking into account all possible events or influences that could reasonably affect the system or process being studied •Presents a set of accident or mishap scenarios & their associated consequences & probabilities of occurrence. •The first comprehensive PRA, the Reactor Safety Study (WASH-1400) by the Nuclear Regulatory Commission, was completed in the mid-1970s. •2 primary references: –PRA Procedures Guide for Nuclear Power Plants (NUREG/CR-2300) –Probabilistic Risk Assessment Procedures Guide for NASA Managers and Practitioners (NASA/SP-2011-3421) . • Initiating Event is a departure from desired operation to a system state where a control response is required either by human or machine intervention •Initiating Events can be identified through the use of logic tools such as (MLDs) & (FMEAs) Master Logic Diagram is a hierarchical, top-down method used to derive Initiating Events –General types of undesired events are shown at the top –More detailed event descriptions are shown at the lower tiers .–Initiating Events are shown at the bottom of the diagram •Its purpose is to identify a comprehensive set of Initiating Events & to group them wit respect to the challenge they pose to the system. Event Sequence Diagram (ESD) is a flowchart that shows the progression of an initiating event to all the possible end states. –Human actions & system responses, including software, to initiating events are considered & the resulting paths leading to different end states are shown. •Most commonly used discrete distributions are the Binomial & the Poisson distributions • continuous distributions are the Gamma, the Log-Normal, & the Weibull distributions. Uncertainty Analysis: development of scenarios introduces uncertainties due to model assumptions & model parameters.

Common Cause Failure (CCF) failure (or unavailable state) of > one cmpnent due to a shared cause. •The only feasible approach to the analysis of common-cause initiators is to treat them explicitly. •In most cases (e.g., earthquakes, fires, and floods), it is necessary to employ event-specific models to aid in estimating the frequency of initiation as a function of magnitude and the conditional probability of failure for plant systems and components. •In other cases, such as the loss of electric power, these models might simply consist of the statistical analysis of data from operating and maintenance experience. •CCFs caused by two factors: –Root Cause, i.e., the reason (s) for failure of each component that failed in the CCF event –Coupling Factor(s) – characteristics of a grup of items tht makes them susceptible to the same failure causal factors. •EX, failure of two identical redundant electronic devices due to exposure to excessively high temperatures is a result of: •Susceptibility of each of the devices to heat (Root Cause) and •A result of both units being exposed to the same harsh environment (Coupling Factor). 4 major classes of coupling factors: •Hardware –Design –Quality •Operations –Procedures –Operators –Maintenance/Test/Calibration •Environment –Location (vibration, thermal, g forces, etc.) –Internal Enviro. (fluids, lubricants, etc.) •Software –Algorithms –Data –Design requirements . PURPOSE: to identify susceptibilities in the design and to identify specific events that should be added to the Fault Tree. •Screening should include: –Review of the system design –Review of the operating, maintenance, and test procedures –Review of historical records –Review of analogous systems –Evaluation of “coupling factors” .

Sneak Circuit Analysis. SCA is a detaild design analysis method used to evaluate all possible paths that a process could take. • It is applicable to all types of control and energy delivery circuits (i.e., electrical, hydraulic, pneumatic, etc.). – The most common application is to evaluate electrical circuits is to uncover latent (sneak) circuits and conditions that either inhibit desird functions or cause a hazard or undesird effect to occur, assuming all components are functioning properly • Analysis is usually performd on the “as--‐built” engineering drawings and schematics. Sneak path --‐ latent path or condition that inhibits a desird condition or initiates an unintendd/unwantd response • Sneak clues --‐Checklist of items to assist in the identification of a sneak path. Clue lists are developd basd on prior experience and study of similar systems • Node --Circuit component. In an electrical system, components such as resistors, switches, etc. are nodes. • Nodal sets --‐ Interconnectd nodes that make up a circuit • Paths --‐ Route comprisd when all of the nodes in a nodal set are connectd. • Network Trees – Simplifid diagram to represent the circuit • Topograph --‐ Topological patterns that appear in a network tree. “H” pattern usually has the highest incidence of problems • Primarily due to the higher number of power sources, returns, loads, and switches •Problems normally occur in the “H” crossbar, which includes S3. • Can result in power reversals, ground reversals and current reversals.

Event Tree Analysis. Bottom-up, deductive.• symbolic logic to generate both success anti failure models in specific domain • Applicable to: – Physical systems, wit(out) human operators – Supports decision--‐making/management systems regarding risk —taking in system operations. Explores system Responses to initiating “Challenge” and enables Probability Assessment of Success/Failure.Example “Challenges” (failures or faults, etc.) – Pipe of vessel burst– Ignition of stord combustibles – Technology need – Normal system operating command – Utility system failure – Heightend business competition – Outbreak of epidemic. Event Tree Procedure: 1. Identify initiating challenges 2. Determine the paths(alternate logic sequences) 3. Determine prob. of initiating event by apply fault tree or other analysis. 4. Determine prob. of each potential path by multiplying the individual prob. of the events that make up both paths. 5. Determine the prob. of the system success by adding the prob. for all paths terminating in success. 6. Do the same wit failures.