Application of Bayesian methods to event trees with case studies Текст научной статьи по специальности «Медицинские технологии»

APPLICATION OF BAYESIAN METHODS TO EVENT TREES WITH CASE STUDIES

G. Unnikrishnan1*, Shrihari2, Nihal A. Siddiqui3

1,2,3Department of Health, Safety & Environment, University Of Petroleum and Energy Studies, Dehradun, India

*email: [email protected] ABSTRACT

Event trees are used extensively to analyze accident scenarios in several domains. The tree and its branching structures are used to represent the failure of successive barriers to an initiating event. The end positions of the branches indicate the outcome of progression of each scenario. When probabilities are assigned to success and failure of each barrier the end probabilities can be calculated fairly easily. The logical sequence of the events is clear from the tree structure. However Bayesian networks (BN) are directed acyclic graphs with the nodes indicating events and connected arcs indicating the relationships between the nodes. Initial probabilities are assigned to the parent nodes and conditional probabilities of child nodes are worked out using Bayes Theorem. Bayesian network is a probabilistic modeling technique. Event trees can be mapped into Bayesian networks. Once an event tree is mapped as a Bayesian network, forward (same as in event trees) and backward analysis (possible but involved in event trees) can be performed. Additionally BN has the flexibility for adding causal factors that influence the events. It offers a different perspective of probabilities and better understanding of the incident scenarios. This paper will present mapping of event trees typically found in process industries to Bayesian networks with case studies

1. INTRODUCTION

Event trees are used widely in the process industries to represent incident scenarios. They are used to show the probabilities of success and failure of protective barriers and progression of an initiating event to several potential scenarios. Guidelines for Hazard Evaluation Procedures by Center for Chemical Process Safety (2008) [1] describes the method in detail. Bearfield & Marsh (2005) [2] argued that event tree and Bayesian network are complimentary and both models can be used together to have a better understanding of the potential incident scenarios. They presented event tree for a train derailment initiating event and mapped it in to a Bayesian network.

Other authors namely Bobbio et al (2001) [3], Khakzad et al (2012-1) [4] have explained how to map fault trees and bow ties into Bayesian network respectively. In the latter paper Khakzad et al (2012-1) [4] explained mapping of an event tree which is a part of bow tie, to a Bayesian net. They mapped an event tree for an initiating event of gasoline release followed by possible ignition and consequences of vapor cloud or pool fire. Kalantarina et al (2010) [5] presented part of an event tree for outcome of failure of ISOM unit at BP Texas City Refinery accident in connection with their paper on modeling of BP Texas City refinery accident using dynamic risk assessment approach. Khakzad et al (2012-2) [6] discussed dynamic risk assessment using bow tie approach specifically stating that usefulness of Bayesian approach in updating generic information with site specific data. The paper presented a case study of a dust explosion at a sugar manufacturing facility using bow tie model consisting of Fault Tree and Event Tree. The event tree consisted of 3 barriers namely; high concentration barrier, primary explosion barrier and venting barrier. However details of how the event trees have been mapped into Bayesian network is not discussed in the above two papers.

This paper will describe the method of mapping event trees into Bayesian networks and its usefulness in getting a different picture and better understanding the incident probabilities of process facilities with examples.

Section 2 gives brief introduction to Bayesian networks, section 3 presents event trees and corresponding equivalent Bayesian Networks (BN) with case studies for process industry incidents. Section 4 will present discussion on the potential use of Bayesian networks mapped from event trees for process industry applications.

2. BAYESIAN NETWORKS

A Bayesian Network (BN) is a directed acyclic graph (DAG) in which the nodes represent the system variables and the arcs symbolize the dependencies or the cause-effect relationships among the variables. A BN is defined by a set of nodes and a set of directed arcs. Probabilities are associated with each state of the node. The probability is defined, a priori for a root (parent) node and computed in the BN by inference for the others (child nodes). Each child node has an associated probability table called conditional probability table (CPT).

The computation of the net is based on the Bayes Theorem which states that if P (B) is probability of B happening, then P (A/B) is probability of A happening given that B has happened, given P (B) not equal to zero.

This is equal to:

From fundamental rule of conditional probability

P (A/B) = P (A n B) = P (A, B) 1

P (B) P (B)

Using the rules of probability to rewrite P (A, B) as P (B/A) (A), we get the common form of Bayes equation

P (A/B) = P (B/A) X P (A) 2

P (B)

In Bayesian terminology, the right hand side represents the prior situation -which when computed gives the left hand side -called posterior values. The value P (A) is the prior probability and P (B/A) is the likelihood function -which is data specific to the situation. P (B) is the unconditional probability of B- which is calculated from the rule

P (B) = P (B/A) X P (A) + P B/A' X P (A') 3

Where A' stands for A not happening

The Bayes equation (2) can be applied to several nodes using laws of probability.

The above concept is used to represent typical conditional probability, namely cause & effect or

hypothesis & evidence as shown in the form of a simple Bayes nets in Figure 1 a & b

Figure 1 a: Bayes Net for cause and effect Figure 1 b: Bayes Net for Hypothesis and

Evidence

Corresponding equations are: For cause & effect

P (C/Ef) = P (Ef/C) X P (C) For Hypothesis & Ev P (Ef)

P (H/E) = P (E/H) X P (H) Extension of the prii P (E)

Figure 1c: Bayes net for gas leakage & Ignition

Corresponding equation will be:

P (Gas/Ig) = P (Ig/Gas) X P (Gas) 6

P (Ig)

3. EVENT TREES AND BAYESIAN NETWORKS: PROCESS INDUSTRY APPLICATIONS

3.1 The flexibility of bayesian network can be demonstrated by a simple example.

Let us assume that the probability of an Emergency Shut Down Valve (ESDV) working is 0.85. Conversely probability of ESDV not working is 0.15. If ESDV works the probability of Safe Shutdown is 0.97. If ESDV does not work the probability of Safe Shut down is only 0.02. (The probability values are hypothetical and not from any database). The situation can be represented as an Event tree given in Figure 2 below.

Figure 2: Event tree for ESDV action and Safe shutdown

From the Event Tree the following can be calculated:

4

5

Probability of Safe Shutdown = 0.8245 + 0.0030 = 0.8275 Probability of Unsafe situation= 0.0255 + 0.1470 = 0.1725

The Even tree can be converted to a Bayesian Network shown below in Figure 3.

Figure 3: BN for Event tree for ESDV action and Safe shutdown Further, the conditional probability statements are expressed as a table below: Table1: Conditional probabilities for Safe Shutdown

ESDV works Safe shutdown

T F

T (0.85) 0.97 0.03

F (0.15) 0.02 0.98

In order to fully appreciate the flexibility of BN, it has to be modeled in suitable software. Author has used Netica™ from Norsys Corporation. Other modeling software are also available. Model of the above scenario is shown in Figure 4 below.

ESDVW /Vorks

T 85.0 F 15.0

SafeSh utdown

T 82.7 F 17.3

Figure 4: Bayesian Network model for ESDV and Safe shutdown

The model has calculated the forward probabilities which are same as the results from Event Tree. Now we have a situation where we know that Safe Shutdown has occurred. Then what is the probability that ESDV has worked?

In order to calculate the same, Bayes theorem has to be used which is illustrated below: Probabilities of Safe Shutdown and No Safe Shutdown, given that ESDV has worked

P Safe Shutdown = 0 97 7

ESDV works-True

_ Safe Shutdown _ „ _

P - — 0.02 8

ESDV works- False

Applying Bayes theorem for finding the probability ESDV working given there is Safe Shutdown:

_ ESDV Works-True _ Safe Shutdown „ ^^.-..-.t^tt t.t i m n

P- — P- X P(ESDV Works — True)

Safe Shutdown ESDV works- True

9

P (Safe Shutdown)

In the above expression, right hand side numerator values are known. The unconditional probability of Safe Shutdown P (Safe Shutdown) in the denominator needs to be calculated.

P (Safe Shutdown) =

P(ESDV Works - True) X P Safe shutdown + p^DV Works - False) X P

v J ESDV works-True v J

Safe Shutdown

ESDV works- False

— 0.85 X 0.97 + 0.15 X 0.02 — 0.8275 10

Substituting the above value in the equation 9

P Safe Shutdown = 0.97 x 0.85 — 0.9963

ESDV works- False

0.8275

The above computation can be readily achieved in the Bayesian simulation by changing the Safe Shutdown True to 100%. The computation is propagated backwards using the Bayes theorem to give the result as 0.9963 as shown in Figure 5 below

ESDVW /Vorks SafeSh utdown

T 99.6 F 0.36 T 100 F 0 ; ;

Figure 5: Bayesian Network model for Safe shutdown 3.2 Further case studies are given in the following sections 3.2.1 Case study No.1: Flammable & toxic gas leak 3.2.1.1 Event Tree

Event trees model an incident as a sequence of events. Each event has success or failure probability. The event tree branching is created from left to right, starting from an initiating event and continuing to the sequence of events (failure of barriers) till a logical consequence is obtained. As example of event tree for flammable and toxic gas leak is given in Figure 6.

Ignition Ignition Explosion Consequences

timing conditions

Probability

Yes

T4 _Cloud

T3 late ignition

T2

T1

Yes 0.02

Gas Leak

F2

Yes 0.9

0.3

F4

No 0.4

F3 Early ignition 0.7

No

0.1

explosion

0.02X0.9X0.3X0.6 = 0.00324

.Fireball 0.02X0.9X0.3X0.4 = 0.00216

-Jet Fire 0.02X0.9X0.7 =0.0126

Toxic gas

"Release 0.02X0.1 = 0.002

Fl

No

0.98

.No gas leak

= 0.98

Figure 6: Event tree for Flammable & toxic gas leak

If flammable & toxic gas release is the initiating event (probability of which is given) then four types of incident scenarios are possible, depending on the probabilities of ignition, early or late ignition and explosion conditions.

Once the probabilities of all branches of the event trees are known, the consequence probabilities are worked out by multiplying the initiating probability with the probabilities in the corresponding branches of the event tree as shown in Figure 6. Sum of probabilities at any branching point should be equal to 1. Binary branching like success or failure is the most common branching used. More than two branches are also possible.

With an initiating event probability of gas leak as 0.02, the probabilities of the consequence are calculated and shown on right hand side of the Figure 2. The probabilities used are for illustration only and have not been taken from any database.

3.2.1.2 Bayesian Network (BN)

Figure 7 shows the corresponding BN for the flammable and toxic gas leak scenario shown in event tree in Figure 6.

Figure 7: Bayesian Network (BN) for flammable & toxic gas leak

When translating to Bayesian Network (BN), following transformations have been done:

■ Branching point in Event Tree Node in BN

■ Branches in Event Tree — Connecting arcs in BN showing relationship between nodes

■ Branching conditions in Event Tree —Node states in BN

For example, the two braches for condition 'Ignition' in Figure 6 is captured in node states Y (yes) and N (No) with probabilities of 0.9 (yes) and 0.1(no) respectively in Figure 7 of the corresponding BN. Node states are given in the tables shown adjacent to the node with the probability values. The conditional probability is given above the node state, which is the precondition for the event to reach the node

3.2.1.3 Bayesian Network (BN) simulation for gas leak.

The BN simulation model for flammable & toxic gas leak event tree is given in Figure 8.

GasLeak

T 2.00

F 98.0

Figure 8: Bayesian Network (BN) simulation model for flammable & toxic gas leak

Table 2 e: CPT for Consequences

Gonseq:

GasLeak Ignition Igiition Timing B<plosionGond QoudExp Fi reBall Jet Fr e ToxjGösRe) NoGasLeak

T T Late Yes 1 0 0 0 0

T T Late No 0 1 0 0 0

T T Late NoGbsLeak 0 0 0 0 0

T T Early Yes

T T Early No

T T Early NoG&sLeak 0 0 1 0 0

T T NoGasLeak Yes

T T NoGasLeak No

T T NoGasLeak NoG&sLeak

T F Late Yes

T F Late No

T F Late NoG&sLeak

T F Early Yes

T F Early No

T F Early NoG&sLeak

T F NoGasLeak Yes

T F NoGasLeak No

T F NoGasLeak NoG&sLeak 0 0 0 1 0

T NoGasLeak Late Yes

T NoGasLeak Late No

T NoGasLeak Late NoG&sLeak

T NoGasLeak Early Yes

T NoGasLeak Early No

T NoGasLeak Early NoG&sLeak

T NoGasLeak NoGasLeak Yes

T NoGasLeak NoGasLeak No

T NoGasLeak NoGasLeak NoG&sLeak

F T Late Yes

F T Late No

F T Late NoG&sLeak

F T Early Yes

F T Early No

F T Early NoG&sLeak

F T NoGasLeak Yes

F T NoGasLeak No

F T NoGasLeak NoG&sLeak

F F Late Yes

F F Late No

F F Late NoG&sLeak

F F Early Yes

F F Early No

F F Early NoGbsLeak

F F NoGasLeak Yes

F F NoGasLeak No

F F NoGasLeak NoG&sLeak

F NoGasLeak Late Yes

F NoGasLeak Late No

F NoGasLeak Late NoG&sLeak

F NoGasLeak Early Yes

F NoGasLeak Early No

F NoGasLeak Early NoG&sLeak

F NoGasLeak NoGasLeak Yes

F NoGasLeak NoGasLeak No

F NoGasLeak NoGasLeak NoG&sLeak 0 0 0 0 1

Node probabilities are entered in the Conditional Probability Table (CPT) as indicated in Tables 2 a, b, c & d. The state 'NoGasLeak' has to be continued in from the second CPT for 'Ignition' to all subsequent CPTs in order to meet the criteria that the sum of probabilities at every branch point has to be equal to 1.

Table 2 a: CPT for gas leak

GasLeak:

T F

0.02 0.98

Table 2 b: CPT for Ignition

Ignition:

GasLeak T F NoGasLeak

T 0.9 0.1 0

F 0 0 1

Table 2 c: CPT for Ignition timing

IgnitionTiming:

Ignition Late Early NoGasLeak

T 0.3 0.7 0

F 0 0 1

NoGasLeak 0 0 1

The above model can be further presented in a more compact form. The simulation diagram and the conditional probability tables for the compact form are given below in Figure 9 and Tables 3 a, b, c, d:

GasLeak Ignition

I 2.00 F 98.0 i i i - > T 1.80 F 0.20 NoGasLeak 98.0 i i i

IgnitionTiming

Late 0.54

Early 1.26

Nolgnítíon 0.20

NoGasLeak 98.0

Explosione ond

Yes 0.32

No 0.22

Earlylgn 1.26

Nopn 0.20

NoGasLeak 98.0

Conseq

CloudExplosion 0.32

FireBall 0.22

JetFiie 1.26

ToxicGasRelease 0.20

NoGasLeak 98.0

Figure 9: Compact Bayesian network simulation model for flammable & toxic gas leak CPT tables for the compact model are given below:

Table 3 a: CPT for GasLeak

GasLeak

T F

0.02 0.98

Table 3 b: CPT for Ignition

Ignition

GasLea T F NoGasLea

T 0.9 0.1 0

F 0 0 1

Table 3 c: CPT for Ignition Timing

IgnitionTiming

Ignition Lat Earl NoIgnitio NoGasLea

T 0.3 0.7 0 0

F 0 0 1 0

NoGasLe 0 0 0 1

Table 3 d: CPT for ExplosionCond

ExplosionCond

IgnitionTim Yes No Earl NoIgnitio NoGasLea

Late 0.6 0.4 0 0 0

Early 0 0 1 0 0

NoIgnition 0 0 0 1 0

NoGasLeak 0 0 0 0 1

Following are to be noted in this context:

a. The software has the capability to set up the equations when the nodes, its connectivity's and node probability tables are established. Normally there is no need to enter the equations manually when using discrete values. Failure distribution can be used. Then the equations will be entered in the appropriate input box.

b. What is required is careful consideration of the dependencies(cause & effect), its probabilities and node states

c. The node states have to match the number of branches under each event.

d. The probability values are entered for each node state in the conditional probability (CP) table as given in Tables 2 a, b, c & d and 3 a, b, c, and d. For a node the sum of state probabilities should be equal to 1.

e. The initiating event tree branches can have probability values associated with it instead of having a probability of 1 & 0. In such cases, the unsuccessful (F) branch has to be included as a node state in the BN.

f. In an event tree the sum of probabilities at a branching point is 1. Similarly in the conditional probability table, the sum of probabilities of each state has to be 1. The sum of the computed conditional probabilities for each node in the BN (as shown in Figure 4) also has to be 1. Therefore to take care of the requirement of sum of conditional probabilities to be 1 at a node, the unsuccessful (F) state at the initiating node has to be continued in the Conditional Probability Table (CPT) for the successive nodes. Thus the state called 'NoGasLeak' state has to be indicated in all the CP tables as given in the above example for Gas Leak (F=0.98). 'NoGasLeak' state is indicated in all CP tables of nodes continued up to the 'Consequences'. When this unsuccessful (F) state is included in the CP table, the sum of the conditional probabilities at each node will sum to 1. In essence it is state of the nodes and its probability values that capture the branching points of an event tree.

g. The software does not display the CP tables in the nodes as such, but give the calculated conditional probability values for each state. The CP values given as inputs are hidden from the normal view. For example the 'Ignition' node in Figure 4 & 6 (which is a screen shot) displays the conditional probability for ignition when there is a gas leak in percentage. (100* 0.02 X 0.9 =1.8)

The last node 'Consequences' is a function node for summing up the consequences. (In this case each outcome is different).

Once the BN is set up, it can be used for predictions as well as diagnostics. Predictions are forward calculations from left to right; for example if there is a definitive gas leak, the probability of gas leak goes up to 1.0. In the event tree the consequences can be worked out by revising the value for initiating event. In the BN model this can be done by changing the probability of gas leak to 100 as shown in Figure 10.

GasLeak

T 100 F 0

! ! !

Ignition

T 90.0 F 10.0 NoGasLeak 0

i

IgnitionTiming

Late 27.0

Early 63.0

NoIgnition 10.0

NoGasLeak 0

ExplosionCond

Yes 16.2

No 10.8

EarlyIgn 63.0

NoIgnition 10.0

NoGasLeak 0

Conseq

CloudExplosion 16.2

FireBall 10.8

JetFire 63.0

ToxicGasRelease 10.0

NoGasLeak 0

Figure 10: BN simulation model for prediction of consequences for gas leak

While event tree can also calculate this forward calculation easily, it is comparatively difficult to do the reverse, which is diagnostics.

Diagnostics involve finding out the most probable causes for occurrence of an event. In this case BN is flexible. BN uses equation 2 for calculating the probability of causes. For example, with all probabilities remaining the same, we can enter the state for the actual consequence scenario, Jet fire -which has happened as 1, then the BN model will recalculate the probabilities of all precursor events in the tree. Here in this case, the BN shows that, given there is a jet fire, there has been a gas leak and ignition with early timing. See Figure 9.

GasLeak

T 100 F 0

Ignition

T

F

NoGasLeak

IgnitionTiming

Late 0 Early 100 NoIgnition 0 NoGasLeak 0

Yes No

Earlylgn

NoIgnition

NoGasLeak

Conseq

CloudExplosion FireBall JetFire 100 ToxicGasRelease NoGasLeak

Figure 11: Bayesian network simulation for Jet fire scenario

The above presents a simple case. The event tree logic and corresponding BN can be set up to any level of complexity and used for forward (predictions) and backward (diagnostics).

3.2.2 Case study No.2 Tank high level 3.2.2.1 Event Tree

The second example is the event tree for tank high level shown in Figure 10. The probabilities have been worked out the same way as in Figure 2. (Probabilities used are only for illustration) Corresponding BNs are described in the next section.

Alarm alerts Operator High level ESDV action Consequences operator action transmitter

Success _ Continue

operations

T2

Yes

T1

Tank

high level

Fl

0.7

F2

0.7X0.9 = 0.63

0.9

Fails

T5

T3 Works

0.1

F3

0.85

Fails

F5

Acts

0.95

Fails

0.05

0.15

T4 Works

Safe 0.7X0.1X0.85X0.95 = 0.0565 shutdown

0.7X0.1X0.85X0.05 = 0.002975 ■ Overflow

-Overflow 0.7X0.1X0.15 = 0.0105

T6

No

0.3

F4

0.85

F6

Acts

0.95

Fails

_Safe shutdown

0.3X0.85X0.95 = 0.242

0.05

Fails

0.15

-Overflow 0.3X0.85X0.05 =0.01275 . Overflow 0.3X0.15 = 0.045

Figure 10: Event tree for tank high level 3.2.2.2 Bayesian Network for tank high level

BN for the tank overflow event tree in Figure 10 is given in Figure 11. Here high level is considered as occurred and so probability of 'Tank high level' is 1.

Node probability tables have been entered the same way as given in Tables 3 a, b, c, d & e BN Simulation diagram is given in Figure 12

Figure 11: BN for tank high level

Level High

T 100 F 0 VT

HighLevelAlarmftlertsOP

T1 70.0 F1 30.0 NA1 0

OPAcfon

T2 63.0

F2 7.00

IMamCondtion 30.0

HighLeveiïranActs

OPActionSafe 63.0 ^^^ :

T3 5.95 F3 1.05 T4 25.5 F4 4.50 -i

ESDV&lvefcts

OPAdionSafe 63.0

i^^B ;

T5SafeSD 5.65

F50vei1low 0.30

F30vertow 1.05

TSSafeSD 24.2 U

FSOverlow 126

F40ver8ow 4.50

Consequences

ContiriueOperaiions 63.0 SafeSD 29.9

Overflow 7.12

Figure 12: Bayesian network simulation diagram for tank high level scenario 3.2.2.3 Additional factors in BN

Another possibility in BN is the inclusion of additional casual factors that contributes to the probabilities of events.

We can include the testing of the Emergency Shut Down Valve (ESDV) as a causal factor connected to the node ESDVValveActs and give an improved probability of ESDV acting (0.97) instead of 0.95 in the event tree in Figure 10, if the testing is on schedule. While such an addition will require an additional branching in event tree, it can be easily implemented in BN with clear representation as a cause influencing ESDV action.

One more casual factor is added next; namely the type of sensor used for High level detection. For conventional float type the same probabilities (0.85) given in the event tree (Figure 11) is used. But for Radar type an improved probability for action (0.96) has been assigned. Both the causal factors are shown in Figure 13.

Figure 13: Bayesian network simulation diagram for tank high level scenario with addition of causal factors: ESD valve testing (On schedule) & type of high level detection (Radar

type)

Figure 13 shows that:

When ESDV testing is as per schedule and with Radar type transmitter for alarm, there is improved performance of ESDV action (probability of safe shutdown has gone up to 0.348), and the possibility for overflow can be reduced from 7.12 to 2.19.

4. DISCUSSION

Event trees and its corresponding BN offer different perspectives. While event tree indicates the logical sequences of event progression (barrier success & failures) to incident scenarios, BN depicts

the probabilities in a flexible manner offering easy ways for prediction (forward calculations) and diagnostics (backward calculations) of entire tree structure. BN allows additional casual factors to be included and modeled which can show influences of the factors on events directly. The two case studies have demonstrated the flexibility and power of the Bayesian methods. Updating of information can be based on site data. In the examples given, if the organization has records of the actual testing of ESDV or type of level transmitters, the same can be used to predict the incident outcome probabilities of the system with more confidence. Organizational and human factors can also be included which is not normally available in an event tree. The capability for doing predictions and diagnostics of a process system, starting from generic data and updating with site specific data is the main advantage of the Bayesian methods. Since each system is unique, event tree and corresponding BN has to be developed for each. Work is to be done in this area to make the incident probabilities available to decision makers and operational staff.

REFERENCES

[1] Center for Chemical Process Safety., "Guidelines for Hazard Evaluation Procedures, Wiley-AIChE, New York. (2008)

[2] Bearfield, G. and Marsh W., "Generalizing event trees using Bayesian networks with a case study of train derailment", SAFECOMP 2005, LNCS 3688, pp. 52-66 (2005).

[3] Bobbio, A., Portinale, L., Minichino, M., and Caincamerla, E., "Improving the analysis of dependable systems by mapping FTs into Bayesian networks", Reliability Engineering and System Safety, 71, pp. 249-260 (2001).

[4] Khakzad, N., Khan, F., and Amyotte, P., "Dynamic safety analysis of process systems by mapping bow tie into Bayesian network", Process Safety and Environmental Protection, 91, pp. 46-53 (2012)

[5] Kalantarnia, M., Khan, F., and Hawbolt, K., "Modeling of BP Texas city Refinery accident using dynamic risk assessment approach", Process Safety and Environmental Protection, 88, pp. 191-199 ( 2010)

[6] Khakzad, N., Khan, F., and Amyotte, P., "Dynamic risk analysis using bow-tie approach", Reliability Engineering and System Safety, 104, pp. 36-44 (2012)