Elisabeth Paté-Cornell

PRA as a management tool: organizational factors and risk-based priorities for the maintenance of the tiles of the space shuttle orbiter

Abstract A probabilistic risk assessment (PRA) model, developed for the Thermal Protection System (TPS) of the space shuttle orbiter and presented in the previous paper, is used as a management tool to identify root-cause, organizational factors of the various failure modes. The objective is to set priorities in the process of resource allocation to minimize the risk of accident caused by the failure of the TPS. Starting with the technical characteristics of the system and the inputs of the risk assessment model, the approach is to identify the human decisions and actions and the key organizational factors that influence the risk. Among the management factors that affect the reliability of the TPS are time pressures that have occurred in the past, liability concerns and conflicts among contractors, the low status of the tile work and material technicians among maintenance personnel, the absence of priorities in tile testing, and under-recognized couplings among subsystems (such as the external tank insulation as a source of debris that may hit the tiles). It is shown here how using the PRA results to set priorities in the maintenance of the tiles can allow reduction of the overall risk, and how critical zones of debris sources can be identified on the surface of the external tank and the solid rocket booster. It was found, for instance, that detecting and fixing loose tiles in the most risk-critical areas and securing insulation by up to 80%, and securing the insulation of external systems in specified areas could reduce the TPS risk by about 75%.

Probabilistic risk analysis and risk-based priority scale for the tiles of the space shuttle

Abstract The thermal protection system of the space shuttle is one of its most critical subsystems because it protects the orbiter from heavy heat loads at reentry into the atmosphere. To optimize NASAs allocation of risk management resources, a probabilistic risk analysis model is developed for the black tiles, and a risk-criticality index is computed for each tile based on its contribution to the overall probability of loss of vehicle and crew (LOV/C). This assessment is based on the susceptibility of the tiles (i.e. their probabilities of debonding), and on the vulnerability of the orbiter to specific tile losses given the criticality of the subsystems under the aluminum skin in various locations. The two main initiating events are linked to the debonding of a tile, caused either by debris hits or by a weak bond because of poor tile installation. The PRA model relies on a partition of the orbiters surface according to four parameters: the probability of debris hits, the probability of secondary tile loss once a first tile has debonded, the probability of burnthrough given a failure patch of specified size, and the probability of LOV given a hole in the orbiters aluminum skin. The results show that the contribution of the tiles to the overall probability of LOV is about 10%. They also include a map of the orbiters surface showing the relative risk-criticality of tiles at various locations. It was found that 85% of the risk can be attributed to 15% of the tiles, thus allowing the management to allocate more effort and resources to the maintenance of the most risk-critical tiles.

Uncertainties in global climate change estimates

Improvements are disclosed for a process of the type in which copper metal is produced by contacting an aqueous solution containing copper ions with a quinolic compound to result in the precipitation of copper metal. In this type of process, a quinonic compound is also produced during copper precipitation and it may be reduced to the quinolic compound for reuse in precipitating more copper metal.

Patient risk in anesthesia: Probabilistic risk analysis and management improvements

In this paper, we present a pilot study in which we use probabilistic risk analysis (PRA) to assess patient risk in anesthesia and its human factor component. We then identify and evaluate the benefits of several risk reduction policies. We focus on healthy patients, in modern hospitals, and on cases where the anesthetist is a trained medical doctor. When an accident occurs for such patients, it is often because an error was made by the anesthesiologist, either triggering the event that initiated the accident sequence, or failing to take timely corrective measures. We present first a dynamic PRA model of anesthesia accidents. Our data include published results of the Australian Incident Monitoring Study as well as expert opinions. We link the probabilities of the different types of accidents to the “state of the anesthesiologist” characterized both in terms of alertness and competence. We consider different management factors that affect the state of the anesthesiologist, we identify several risk reduction policies, and we compute the corresponding risk reduction benefits based on the PRA model. We conclude that periodic recertification of all anesthesiologists, the use of anesthesia simulators in training, and closer supervision of residents could reduce substantially the patient risk.

Probabilistic risk analysis and safety regulation in the chemical industry

Abstract The recent evolution of risk regulations in general is discussed. The state-of-the-art probabilistic risk assessment (PRA) in the chemical industry and the current use of the results by the industry and the regulatory agencies are examined. The methodology of chemical risk assessment for routine as well as catastrophic release is discussed. More specifically are examined the questions of how to assess and report the uncertainties involved in the risk analysis, and where to include conservativeness. As an illustration, the problem of uncertainties in the dose—response relationships for carcinogens is considered. The adequacy and feasibility of safety goals such as those proposed in the nuclear industry as a basis for regulatory standards are discussed. The notion of coherence of standards is explored and a proposal is made to treat explicitly the analytical uncertainties both in the assessment of the risk and in the safety goals.

Medical application of engineering risk analysis and anesthesia patient risk illustration.

The engineering risk analysis method can be extended to include some human and organizational factors and can be used in the medical domain; this transfer is illustrated by a description of a study of anesthesia patient risk. This study involves first a dynamic analysis of accident risks. The model is then extended by relating the basic events of accident scenarios to the state of the practitioner described by the probability of personal problems that may affect his or her level of competence and alertness. These potential problems, in turn, are linked (by probabilistic relations) to the way the system is managed. This extension of the analytical framework allows assessment of the effect of particular types of practitioner problems and therefore of corresponding risk mitigation measures on the probability of the different accident scenarios. The risk analysis model can then be used as a management tool that permits setting priorities among patient safety measures, based either on the sole benefits of the corresponding decrease of patient risk or on a cost-to-benefit ratio. This probabilistic approach constitutes a departure from the classic risk studies exclusively based on statistical frequencies because it involves both available statistics and expert opinions. It is commonly used in engineering for systems for which there is not enough information at the time when decisions need to be made. I show here how the probabilistic model can be used in the medical field to support patient safety decisions before complete data sets can be gathered or in cases in which some key factors are not directly observable.

Shortcuts in Complex Engineering Systems: A Principal‐Agent Approach to Risk Management

In this article, we examine the effects of shortcuts in the development of engineered systems through a principal-agent model. We find that occurrences of illicit shortcuts are closely related to the incentive structure and to the level of effort that the agent is willing to expend from the beginning of the project to remain on schedule. Using a probabilistic risk analysis to determine the risks of system failure from these shortcuts, we show how a principal can choose optimal settings (payments, penalties, and inspections) that can deter an agent from cutting corners and maximize the principals value through increased agent effort. We analyze the problem for an agent with limited liability. We consider first the case where he is risk neutral; we then include the case where he is risk averse.

Probabilistic Risk Analysis Versus Decision Analysis: Similarities, Differences and Illustrations

The methods of engineering probabilistic risk analysis and expected-utility decision analysis share a common core: a probabilistic model of occurrences of uncertain events. This model is based on systems analysis and on the identification of an exhaustive and mutually exclusive set of scenarios, their probabilities and their consequences. Both methods rely on an assumption of rationality and the use of Bayesian probability, and both assume separation of probability assessments and of preferences among scenarios’ outcomes. The major differences are rooted in the nature and the framing of the problems that they address. A risk analysis is often performed before decisions have been fully defined, and one of its objectives is then to identify and characterize risk mitigation options. Furthermore, at the time of the analysis, the decision maker who will eventually use the results is often unknown. Therefore, the definition of Bayesian probability as a degree of belief has to be adapted, for instance, by assuming implicit delegation of the user’s judgment to the analyst and the experts, which requires special care in the presentation of the results. Also, a risk analysis is often performed for a single system (e.g., one aircraft) for one unit of time or operation (e.g., one takeoff and landing cycle) when in reality, the analysis may be intended to support risk management decisions that will eventually concern an unknown number of similar systems for an unspecified number of time units. This multiplicity has implications for the treatment of second-level uncertainties (about failure probabilities) and for the need to display these uncertainties in the results. In this paper, the two classical definitions of probability (Bayesian and frequentist) are discussed, focusing on their relevance to both probabilistic risk analysis and decision analysis, when facing aleatory uncertainties (randomness) as well as epistemic uncertainties (limited knowledge about a fundamental phenomenon of interest). The risk and decision analysis methods are then briefly described, along with their similarities and differences. Two illustrations are presented: an analysis, performed in 1990, of the risk of losing a NASA orbiter and its crew due to a failure of the tiles of the thermal protection system, and a method of assessment of the risk of a terrorist attack on the United States in a given time frame, based on available intelligence information (a 2002 study). The latter involves the use of a simple analysis of a game involving alternating decisions and moves by terrorists and the US using a rational model in the descriptive mode. The main conclusion is that whereas the role of the decision analyst is to represent faithfully the beliefs and preferences of a known decision maker in order to identify the preferred alternative, the risk analyst needs to be scrupulous in presenting the model assumptions, as well as the sources and the methods of data processing to allow future decision makers to exercise their own judgments when using the results.

Managing fire risk onboard offshore platforms: Lessons from Piper Alpha and probabilistic assessment of risk reduction measures

The offshore oil platform Piper Alpha was destroyed in July 1988 by a catastrophic fire. The causes of the accident included a combination of technical and organizational factors. In this paper, I describe the accident, its chronology, and the dependencies involved. I then examine some of the human errors that led to the disaster and their organizational roots, such as economic pressures, the permit-to-work system, and the inadequacy of regulatory oversight in the United Kingdom at the time of the accident. Risk-reduction measures can be costly, however, and priorities must be set based on costs and benefits. To this end, I describe a probabilistic risk analysis model that can be used to assess the benefits of different fire safety measures, focusing on reinforcing the emergency water pumps.

Hybrid Systems for Failure Diagnosis

Optimization as well as heuristics can be used as a basis for decision support systems for failure diagnosis and repair. The object of this paper is to discuss the desirability and the characteristics of hybrid decision support systems, designed to operate in three different modes either on the basis of probabilistic risk analysis (PRA) models, or on the basis of heuristics, or in a simple information mode, according to the nature of the failures and the decision circumstances. This paper presents first an overview of the capabilities of current approaches to failure diagnosis (in particular, their treatments of uncertainty) and a discussion of the basic issues in the diagnosis and repair of complex systems. The argument then focuses on a PRA-based method for the optimization of inspection and repair procedures when the objective is “minimum repair” (restoring the system to an operational mode under time or resource constraints) and on the inclusion of this analytical model in an extended expert system, partly model-based and partly rule-based. This method is illustrated by the case of a hypothetical discrete engineering system.