Open Access is an initiative that aims to make scientific research freely available to all. To date our community has made over 100 million downloads. It’s based on principles of collaboration, unobstructed discovery, and, most importantly, scientific progression. As PhD students, we found it difficult to access the research we needed, so we decided to create a new Open Access publisher that levels the playing field for scientists across the world. How? By making research easy to access, and puts the academic needs of the researchers before the business interests of publishers.
We are a community of more than 103,000 authors and editors from 3,291 institutions spanning 160 countries, including Nobel Prize winners and some of the world’s most-cited researchers. Publishing on IntechOpen allows authors to earn citations and find new collaborators, meaning more people see your work not only from your own field of study, but from other related fields too.
To purchase hard copies of this book, please contact the representative in India:
CBS Publishers & Distributors Pvt. Ltd.
www.cbspd.com
|
customercare@cbspd.com
The significance of event scenarios from a variety of natural hazards —from seismotectonic over meteorological, hydrological up to biological ones — to all types of industrial facilitieshas been recognized in the near past and needs to be addressed systematically in the safety assessment. The most recent approaches for assessing the risk contribution from these hazards and their consequences start with a site-specific qualitative as well as quantitative screening of those individual hazards and event combinations with such hazards, which can be directly related, correlated, or occur independently during the mission time of another. In the second step, for those hazards and hazard combinations remaining with a non-negligible occurrence frequency, a detailed analysis of the facility-specific event scenario including interdependencies between the hazards to be considered, and the safety features and countermeasures in the facility being investigated is conducted in order to estimate the corresponding risk contribution and consequences.
Bundesamt für kerntechnische Entsorgungssicherheit (BfE), Germany
Roewekamp Marina
Gesellschaft für Anlagen-und Reaktorsicherheit (GRS) gGmbH, Germany
*Address all correspondence to: bergheinzpeter@gmail.com
1. Introduction
Natural hazards frequently cause disturbances for different types of critical infrastructures and, therefore, have a substantial impact on the safe and reliable operation of the respective infrastructures such as telecommunication, processes, and energy industry. Furthermore, the set of natural hazards can strongly affect the different types of transport infrastructures such as road, rail, waterways, and aviation.
In case of the electrical power industry, the impact, in particular of seismotectonic, hydrological, and meteorological hazards, is diversified. Examples are the energy production and the transmission and distribution lines of the suppliers where strong winds like tornados result in a disruption of the production (e.g., in case of wind turbines) or of the distribution lines due to trees fallen on overhead lines. An expected low water level may require the shutdown of a nuclear power plant because of potential core cooling problems.
Hazards can arise not only individually but often occur together with other events or hazards. The experience has shown that a variety of combinations of different types are possible. If and how frequently such hazard combinations do occur at a nuclear facility site depends on the site characteristics but also on the facility to be investigated and its design against various events.
In particular, for combinations of natural hazards with other events, the operating experience of the more recent past has shown that at least some of the huge amount of theoretically possible hazard combinations cannot be excluded to occur in principle. Some of these combinations represent—like individual hazards—low-frequency, high-damage events, others are more frequent, but the damage potential is much lower (so-called high-frequency, low-damage events).
For systematically considering all hazard combinations having the potential to impair the safe operation of an industrial facility, but enabling the analyst to exclude non-negligible combinations as well, the entire set of hazards, which can be anticipated at the site of the facility being analyzed, needs to be identified. In the second step, the individual hazards have to undergo a qualitative and quantitative screening process. In the third step, hazard combinations have to be identified starting from those individual hazards identified and not screened out by qualitative arguments. For these hazard combinations, again the screening has to be performed.
2. Different types of hazards and hazard combinations
When considering those hazards which may impair the safe operation of an industrial facility, in principle, two types of hazards have to be distinguished: internal and external hazards.
Internal hazards are those occurring under the responsibility of the operator of the industrial facility on the site of the corresponding installations (e.g., one or more industrial plants).
External hazards are those ones occurring independent of the facility being analyzed, off-site, and out of the responsibility of the plant operator. External hazards may result from natural causes—so-called natural hazards—or maybe induced by humans—so-called man-made hazards. Natural hazards can be further subdivided into different classes of hazards corresponding to the types of phenomena covered.
Although this chapter focuses on natural hazards, it is important to list and characterize all types of hazards in order to enable the analyst to perform a complete screening of hazard combinations.
2.1. Systematic binning of hazards
In Table 1, an overview of the different classes of internal and external hazards is given. Tables 2–10 provide for all hazard classes mentioned in Table 1 the binning of individual hazards to the different hazard classes.
For a systematic assessment of the contribution of natural hazards to risk, only the hazard classes A to H have to be considered as initially occurring individual hazards.
2.2. Categories of hazard combinations
When combining hazards with other anticipated events, three different categories of combinations need to be distinguished (see also [1]):
Related events:
Category 1: Consequential (or subsequent) events:
The events are causally related. An initial event, for example, an external hazard, results in another consequential event, for example, an internal hazard. Typical examples are seismic and consequential internal explosion and/or fire, internal fire and consequential internal flooding, external flooding and consequential high energy arcing fault (HEAF) of a component and subsequent fire.
Category 2: Correlated events:
Two or more events, at least one of them representing a hazard, do occur as a result from a common cause. The common cause can be any anticipated event including external hazards. The two or more events correlated by this common cause could even occur simultaneously1. Typical examples are electromagnetic interference (EMI) as common cause for a station blackout (SBO) and an internal fire as two correlated events or Tsunami as common cause for external flooding, internal flooding, and internal fire as three correlated events.
Category 3: Unrelated events:
An initial event, for example, a (external or internal) hazard occurs independently from but simultaneously1 to a hazard without any common cause. Typical examples are external flooding and independent internal fire or explosion, seismic event, and independent internal fire.
For each category of event combinations with hazards involved those combinations, which can occur site-specifically and according to the design and protection features of the facility or plant to be analyzed, have to be identified and undergo a systematic screening. In the frame of the assessment of the contribution of natural hazards to risk, some hazard classes cannot be combined with natural hazards (hazard classes A to H) depending on the category of combinations. This limits the amount of principally possible combinations significantly.
For limiting further detailed analyses only to those hazards and hazard combinations, which can occur at the site and in the facility under investigation, a systematic screening is needed. In Germany, a clearly structured, systematic approach for hazards identification and screening has been developed in the recent past by GRS for probabilistic risk assessment of nuclear power plant sites with respect to hazards [2]. This approach uses for the collection and processing of generic as well as site- and plant-specific information needed for screening and detailed analysis an analytical tool called Hazards Library. Based on the information and data available in general and the plant under investigation, a step-wise screening with a qualitative and a quantitative screening step, first for individual hazards and, based on the results of the qualitative screening, afterwards also for hazard combinations, is done. The screening can be performed semi-automatically based on questions to be answered for the qualitative screening and applying preselected quantitative criteria for the quantitative screening. A schematic overview of the screening approach is given in Figure 1.
Figure 1.
Overview of the stepwise approach for screening of hazards and hazard combinations, from [1].
3.1. Individual hazards screening
The first step is the identification of those hazards, which cannot be directly excluded as practically impossible for the site being analyzed. For the assessment of natural hazards, in this first step, the hazard classes Z and I can be excluded as non-natural hazards.
For a given site, for example a riverine site in central Europe far from any coastal and/or tidal influence in an area with relatively high seismicity and no volcanic history, a variety of natural hazards can be excluded.
3.1.1. Qualitative screening of individual hazards
The qualitative screening of individual hazards, which is mainly based on information available for the site being analyzed and from relevant operating experience, provides a list of site-specific remaining individual hazards, which cannot be physically excluded. Some hazards can be easily screened out from further analysis because of the general conditions not being met at the site, such as hurricane or tropical cyclone, which do only occur in areas with tropic or sub-tropic climate, or sandstorms, which cannot be assumed based on results of detailed analyses (e.g., for siting and design of building structures) being available for the site ground. In case of a plant site on rock, several hazards such as sinkholes can be easily screened out.
As a result, the following individual hazards remain for the site being investigated after qualitative screening:
For these, individual natural hazards remaining after the qualitative screening, the second, quantitative screening step needs to be carried out.
3.1.2. Quantitative screening of individual hazards
The quantitative screening of individual natural hazards needs predefined quantitative criteria for screening out hazards by occurrence frequency or damage frequency. Such criteria are either available in the national or international regulation (e.g., for nuclear power plants, quantitative screening criteria by the regulatory bodies in charge of nuclear oversight are available), or conservative (pessimistic) cut-off criteria have to be defined for the facility to be investigated based on best practices.
For those hazards, for which the quantitative screening step needs to be carried out, the ranges of their occurrence frequencies have to be conservatively estimated. These are compared to cut-off frequency value corresponding to the screening criterion applied by the analyst.
Depending on the design of the facility with its protection measures and the corresponding safety margins for those hazards not screened out by frequency, a decision needs to be taken; one must decide for which hazards a rough risk estimate is sufficient and for which a detailed probabilistic analysis is needed.
For this purpose, the design requirements (national or international ones, for example, by the European Community) and their implementation at the site, for which the risk assessment shall be carried out, together with the site- and plant-specific boundary conditions and precautionary provisions against hazards impact need to be considered.
In case of the facility, for which the screening approach has been verified, the design against natural hazards such as external flooding covers events occurring once in 10,000 years corresponding to an occurrence frequency of 10−4 per year. Less frequent events as well as events with an occurrence frequency close to the design threshold but a damage probability of more than one order of magnitude lower can be screened out quantitatively.
The screening of hydrological (Class B) hazards for the reference site provides the result that B6, B8, and B9a can be screened out and only B2 “flash flood (torrent) by local extreme precipitation”, B3 “flooding by melting snow” and B4 “flooding by extreme precipitation outside the plant boundary” remain for more detailed risk assessment. With respect to meteorological hazards (Class C), only C16 “high wind” remains at least for a rough analysis. Individual biological hazards are also screened out by frequency.
Those individual hazards screened out are stored in a list L0,individual, those remaining after screening have to be considered for risk assessment and are stored, depending on their damage frequencies either in a list Lrough,individual for only rough risk estimates or in a list Ldetail,individual for detailed analyses.
3.2. Hazard combinations screening
For a comprehensive Hazards probabilistic risk assessment according to the state-of-the-art, hazard combinations have to be included in the analyses. Since the number of hazards in Lgen and the resulting combinations is much too high to consider all combinations from the beginning in a generic manner, the screening of the hazard combinations starts from those hazards (Ltotal,individual) which cannot be qualitatively excluded at the nuclear power plant site being analyzed, and this in turn significantly reduces the hazards’ screening effort.
In order to limit the analytical effort, at least for related hazards in a first step only first order combinations are qualitatively as well as quantitatively screened. For those combinations not screened out, potential second order combinations are identified and screened out. If there are still combinations remaining after screening, this process is repeated for the next order of combinations as long as there are combinations not yet screened out.
3.2.1. Qualitative screening of hazard combinations
From the list of individual hazards which may occur at the plant under investigation, different types of hazard combinations (consequential, correlated, and unrelated ones) involving the remaining individual hazards after qualitative screening for rough or detailed analysis (stored in Lrough,individual and Ldetail,individual) are identified. For these site- and plant-specific hazard combinations identified, the qualitative and quantitative hazards screening steps have again to be carried out (cf. Figure 1).
3.2.1.1. Category 1 combinations of consequential hazards
As already mentioned, for screening of causally related event combinations of natural hazards with other hazards, combinations of man-made or internal hazards with consequential natural hazards can be excluded.
For the site being investigated, only few individual natural hazards of the classes A, B, C, E, and F remain after the qualitative screening. For these, physically possible category 1 combinations have to be identified and screened out. As an exemplary result from [3], the following combinations with hydrological (Class B) hazards remain for quantitative screening (Figure 2):
Figure 2.
Result of the qualitative screening for combinations of those hydrological hazards not screened out at the site being investigated with other hazards.
3.2.1.2. Category 2 combinations of correlated hazards
For the qualitative screening of event correlations in the first step, the common causes have to be identified. These have to be systematically correlated to the different consequential events by phenomena. Typical correlations are possible between different hydrological hazards induced by precipitation (C1) as common cause. Examples of results from [3] are provided hereafter in Figure 3.
Figure 3.
Correlations of the hydrological hazards B2, B3, B4, B6a, B8, and B9a not screened out qualitatively with other hazards due to a common cause, from [3].
The final result of the qualitative screening of related hazards for the reference site analyzed is the following:
The longer duration external flooding hazards B3 and B4 resulting from snow melt or extreme precipitation can induce internal flooding hazards I2. All those external hydrological hazards with flooding potential not screened out individually besides B6a can in principle result in biological flotsam at the reference site.
External flooding hazards from various origins and with differing duration B2, B3, and B4 can occur as correlated events from the same root cause or together with the meteorological hazard C1 (precipitation) correlated, for example, by extreme weather conditions. In addition, flash flood B2 and heavy rainwater flooding B4 can occur correlated to F1 (subaerial slope instability).
3.2.1.3. Category 3 combinations of unrelated hazards
Hazards that occur independently of each other have no common cause and are unrelated. The simultaneous occurrence is in general highly unlikely and is therefore investigated on an international level mainly for hazards of longer duration. In the example of the hydrological hazards not screened out qualitatively (B2, B3, B4, B6a, B8, B9a) a broad majority of combinations with unrelated events is not possible or very unlikely.
In the first step, all those individual hazards not qualitatively screened out can be considered for this third category of combinations. This results in a relatively long list of category 3 combinations, for which qualitative screening is necessary.
3.2.2. Quantitative screening of hazard combinations
In the example of a German nuclear power plant site, given cutoff values from the German regulation [4] have been applied to the occurrence frequency and to the damage frequency.
The qualitative screening for category 1 combinations provides the following result for causally related combinations at the reference site with the hydrological hazards B2, B3, B4, B6a, B8, and B9a: Combinations of these hazards with E6 (biological flotsam) and F1 (subaerial slope instability) have been screened out quantitatively. Therefore, no category 1 combinations remain after the quantitative screening; higher order combinations are also not to be assumed.
The following category 2 combinations that remain after qualitative screening for the reference plant site have been analyzed: A meteorite fall (D2) can cause correlations of I2 (internal flooding) with B6a, B8, or B9a. I2 can also occur together with B6a, B8, or B9a as consequence of man-made explosions (Z1, Z4, Z6, Z11, or Z13). Resulting from a common cause such as a thunderstorm precipitation (C1) or F1 (subaerial slope instability) can be observed correlated with B2 or B4. All these correlations have been excluded quantitatively for the reference facility.
For category 3 combinations B2, B3, B4, B6a, B8, or B9a have to be assumed to occur independent from other hazards. Such combinations have only to be analyzed, if their occurrence frequencies exceed a given cut-off value under consideration of the durations of the individual hazards. According to this argumentation, in the example of screening for hydrological hazards for a given German site, only combinations of B2 with B3 or B4 finally remain for further detailed risk analysis.
It could be demonstrated that the remaining number of hazard combinations is significantly lower after qualitative and quantitative screening of hazard combinations.
The plant model for risk assessment of the facility under consideration needs to be extended by taking into account those hazards and hazard combinations remaining after screening. It has to be analyzed, which structural elements, plant operational components, or even complete systems maybe impaired in their required function (so-called initiating events, IEs). That also requires to extend the original list of risk-relevant functional unavailabilities, the so-called basic events (BEs) in the plant model by those ones related to the hazards and hazard combinations to be considered as well as by the corresponding failure dependencies. This requires another two analytical steps:
After identification of the potential hazard induced initiating events, these have also to be screened with respect to their significance for the facility. In this context, it is important to analyze within that screening step if and how far the identified initiating events from hazards do occur quasi simultaneously and need to be modeled as common cause initiating events.
In a further step, the potential unavailability of structure, systems, and components depending on the impact by hazards needs further extension of the risk analysis model of the facility requiring for each hazard and hazard combination not screened out to identify those items which may functionally failing (so-called hazard equipment lists HEL as defined in [3]) and the corresponding failure dependencies (so-called hazards dependency list HDL, details see [3]). Again, for limiting the analytical effort, a reduction of these lists according to their risk significance by qualitative arguments and quantitative criteria is important.
As provided in more detail in [1, 3], the hazard equipment list for a single hazard Hk covers the entire number j of structures, systems, and components SSCj identified to be vulnerable to Hk and for which their failure contributes to the risk induced by Hk:
HkEL=SSC1,…,SSCmHk.
In order to quantify the failure probabilities of the remaining structures, systems, and components vulnerable to the hazard Hk, information from the facility being analyzed such as technical reliability of systems and components and other factors affecting the hazard-induced scenarios like human reliability in case of actions (e.g., for the remaining hydrological hazards B2, B3, and B4 and their combinations, temporary flood protection measures) have to be taken in a predefined period to prevent damage.
In a further analytical step, the dependencies among the failure characteristics of the vulnerable structures, systems, and components need to be investigated. Each dependency in this list HkDL = {D1,…, Dn}Hk is characterized by a triple Dk = {Ak,Sk,ck} of parameters, which include the set of dependent structures, systems, and components Sk, the common characteristics of the elements of Sk (e.g., water level as cause for a flooding hazard-induced dependency) Ak, and a correlation factor ck for the dependency strength. The hazard equipment lists and hazard dependency lists need to be generated based on the corresponding parameters to be estimated and are used for the qualitative plant model extension. For adequately modeling the dependencies between the structures, systems, and components and/or the hazards impact, the fault trees of the analytical risk analysis model need to be modified and multiplied for the different hazards to be considered. In addition, new elements of the fault trees have to be specified (see also [5]) within the database representing a probabilistic model of a plant system.
A schematic overview of the approach for the plant model extension by hazards is given in Figure 4.
Figure 4.
Extension of the model of the facility being analyzed for probabilistic risk assessment of hazards, adapted from [3].
The model extension also needs to take into account any countermeasures for preventing a risk-significant impact to the facility or mitigating the consequences of the hazards such that the damage to the facility remains non-negligible.
A typical example for preventive countermeasures is the timely implementation of rotatable bulkheads or stop logs as temporary means for protecting water ingress in case of flooding hazards. An example for mitigative measures in case of flooding events is the use of portable equipment to remove water from buildings with systems or components needed for safe operation of the facility such that their required function will not be inadmissibly impaired. In this context, the time and flooding scenario-dependent success paths including the manual actions to be taken have to be included in the probabilistic plant model considering also the human factor adequately in the corresponding HRA (human reliability analysis) model. As a result, additional end states (damage states) of the fault trees can be determined.
The systematic assessment of natural hazards including their contribution to risk and their consequences such as physical and operational impacts on critical infrastructures is still of great importance and has to take into account the specific boundary conditions of the site and facility under consideration. The evaluation and (re)modification of planning and technical criteria will potentially influence the scope and placement of future projects, in particular adjustments in construction techniques and systems employed to better reflect the demands of potentially more variable and extreme climatic conditions.
Therefore, a reliable and meaningful assessment of hazards and combination of hazards is important, based on comprehensive, traceable qualitative and quantitative screening analyses as a prerequisite of detailed (probabilistic) safety assessments.
The extensions and enhancements of the methods for systematically considering natural external hazards in risk assessment have been successfully validated as far as applicable for a selected German nuclear power plant site. In this context, the potential for further iterative improvements has been recognized. Moreover, advances in the methodological approach for those hazards, for which according to the site characteristics of the reference plant the methods could not been applied, seem to be necessary. The methodology will be completed in the near future in order to address the entity of hazards of the different hazard classes identified in [2] and the corresponding hazard combinations and to provide a procedure for assessing their risk.
In order to limit the analytical efforts and to prevent mistakes as much as possible in the screening of the huge amount of hazards and hazard combinations, the development of an analytical tool for supporting the screening of hazards has already been started. By means of a scroll down menu based on qualitative arguments formulated as questions to be answered by yes or no, such as “Is the site a tidal site?”, various hazards can be directly screened out qualitatively. The menu offers to provide inputs on a generic or plant design-specific basis. The tool will offer, in a second step, to also semi-automatically perform the quantitative screening by selecting from a predefined menu of quantitative criteria, such as an occurrence frequency threshold value and apply these to those hazards or hazard combinations not qualitatively screened out. The tool will be as far as possible independent of database software products to enable any possible user to apply it without software restrictions. In addition, the output will be documented in simple, written text form as well as graphically.
For the detailed analyses in the frame of hazard risk assessment it is intended to advance the topological modeling methods provided by GRS in the analytical tool pyRiskRobot [5] for an as far as practicable automated integration of event combinations within particular natural hazards in the probabilistic plant models.
The authors would like to thank the German Federal Ministry for the Environment, Nature Conservation and Nuclear Safety (BMU) and the German Federal Ministry for Economic Affairs and Energy (BMWi) for funding and supporting the work presented in this chapter.
References
1.Roewekamp M, Sperbeck S, Gaenssmantel G. Screening approach for systematically considering hazards and hazards combinations in PRA for a nuclear power plant site. In: Proceedings of ANS PSA 2017 International Topical Meeting on Probabilistic Safety Assessment and Analysis, September 24-28, 2017; Pittsburgh, PA, USA: On CD-ROM, American Nuclear Society, LaGrange Park, IL, USA; 2017
2.Sperbeck S, et al. Analysehilfsmittel zur Bereitstellung von Informationen und Daten zur systematischen Durchführung von PSA für übergreifende Einwirkungen, GRS-A-3914, Gesellschaft für Anlagen- und Reaktorsicherheit (GRS) gGmbH, Köln, Germany; April 2018 (in German)
3.Roewekamp M, et al. Methoden zur Bestimmung des standort- und anlagen-spezifischen Risikos eines Kernkraftwerks durch übergreifende Einwirkungen (Estimation of the Site and Plant Specific Risk of a Nuclear Power Plant from Hazards), Technical Report, GRS-A-3888, Gesellschaft für Anlagen- und Reaktorsicherheit (GRS) gGmbH, Köln, Germany; June 2017 (in German)
4.Facharbeitskreis (FAK) Probabilistische Sicherheitsanalyse für Kernkraftwerke. Methoden zur probabilistischen Sicherheitsanalyse für Kernkraftwerke, Stand: August 2005, BfS-SCHR-37/05, Bundesamt für Strahlenschutz (BfS), Salzgitter, Germany; October 2005 (in German). http://doris.bfs.de/jspui/handle/urn:nbn:de:0221-201011243824
5.Berner N, Herb J. Weiterentwicklung der Methodik zur automatisierten Integration übergreifender Einwirkungen in PSA-Modelle der Stufe 1, Technischer Fachbericht, GRS-454, ISBN 978-3-946607-36-6, Gesellschaft für Anlagen- und Reaktorsicherheit (GRS) gGmbH, Köln, Germany; March 2017 (in German). http://www.grs.de/publikation/grs-454
Notes
“Simultaneous” here does not mean that the events occur exactly at the same time but that the second event occurs before the previous one has been completely mitigated.
Written By
Berg Heinz-Peter and Roewekamp Marina
Submitted: 01 November 2017Reviewed: 15 March 2018Published: 05 November 2018
Open access peer-reviewed chapter
