Downloadable - About University

Assessing probabilities for very rare events 291
Central
generator
overheats
0.2
0.9
Secondary cooling
system works
0.8
No
overheating
OK
Automatic shutdown
mechanism fails
0.05
Catastrophic failure
Prob = 0.2 × 0.1 × 0.01 × 0.05
= 0.00001
Secondary cooling
system fails
0.1
Warning system
fails
0.01
0.99
Warning
system works
0.95
Automatic
shutdown works OK
Automatic shutdown Catastrophic failure
mechanism
fails Prob = 0.2 × 0.1 × 0.99 × 0.02 × 0.05
0.05
Manual shutdown
= 0.0000198
fails
0.95
0.02
Automatic
0.98
Manual
shutdown works OK
OK
shutdown works OK
Figure 10.4 – An event tree
∴ p(catastrophic failure) = 0.00001 + 0.0000198
= 0.0000298
to assess the probability that each factor will contribute to it. Then, by
using the multiplication and addition rules of probability, the overall
probability of failure can be calculated (note that, for simplicity, here
it has been assumed that all the factors operate independently). Of
course, it is important to try to ensure that the tree is as complete
as possible so that all possible causes of the event in question are
included (see Chapter 6). However, it may be difficult or impossible to
assess subjective probabilities for such events as human error, deliberate
sabotage, and, by definition, unforeseen weaknesses in a system.
Fault trees
Sometimes it is easier to consider the problem from a different point
of view. In contrast to event trees, fault trees start with the failure or
accident and then depict the possible causes of that failure. For example,
suppose that a decision maker wants to assess the probability that a
vital pipeline in a chemical plant will fracture within the next 12 months.
Figure 10.5 shows a fault tree for his problem. He considers that a
fracture would occur if there is either a defective weld or excess pressure
in the pipeline. Because either event on its own would be sufficient
to cause the fracture these two events are connected to the ‘pipeline
fracture’ node by an ‘or’ symbol. The excess pressure in turn, however,
would only occur if there was both a regulator failure and a failure in the
safety valve, so an ‘and’ symbol connects these two events to the ‘excess
pressure’ node.