PSA selected-consequence contribution workbench

Define a partition before adding anything

• IE-LINE: initial release from the rigid line, excluding the pump shaft seal and flexible hose.
• IE-SEAL: initial release from the pump shaft seal only.
• IE-HOSE: initial release from the flexible transfer hose only.

Assign each included initiating occurrence to exactly one origin. These categories are mutually exclusive per occurrence, not mutually exclusive across a year. Multiple different occurrences may happen during the year. Events with multiple initial origins, unknown origins or an external impact are explicitly excluded. Their omission is a scope gap, never evidence of zero risk.

λ is an already annualized initiating frequency in events per the same synthetic vessel-year and duty profile. a, bS and bF are dimensionless conditional success probabilities for the stated origin and time windows. No rate, operating hour or per-demand conversion is performed. Editable notes document the basis; they do not change the fixed event definitions.

Read the tree as conditional statements

• aᵢ = P(I = S | IEᵢ): isolation succeeds given origin i.
• bSᵢ = P(E = S | IEᵢ, I = S): no sustained fire given that isolation succeeds.
• bFᵢ = P(E = S | IEᵢ, I = F): no sustained fire given that isolation fails.
• S = success; F = failure. I has identity I-F30; E has identity E-NF10. Each origin conditions the same response definitions, not an independent copy of the equipment.

1. First enumerate the four terminal paths. SS has probability a bS; SF has a(1 − bS); FS has (1 − a)bF; FF has (1 − a)(1 − bF). A path probability is conditional on its initiating event.
2. The tree partitions defined outcomes; it does not establish causal chronology or simulate fire progression. The 30 s isolation window lies within the 10 min observation window, and fire may begin before isolation is completed.
3. The chain rule gives P(I=F, E=F | IEᵢ) = P(I=F | IEᵢ) × P(E=F | IEᵢ, I=F). The second factor already conditions on isolation failure. Multiplication here does not assume independent barriers.
4. Multiply each path probability by the corresponding initiating frequency: fᵢ,path = λᵢ × P(path | IEᵢ). The units remain events per vessel-year. A frequency of 0.01/year is not automatically a 1% chance of at least one event in a year; converting it requires a justified occurrence-process model.
5. For each origin, all four path probabilities must sum to 1 and all four path frequencies must sum to λᵢ. These closure checks catch arithmetic or tree-partition errors; they do not establish that the model describes a real vessel.
6. Sum only like end states over the disjoint included initiating-event classes: F_FF = Σᵢ λᵢ(1 − aᵢ)(1 − bFᵢ). This is an aggregate contribution for the stated scope. It is not total ship risk and it does not quantify injury, pollution, fire size or loss.
7. The annual event counts need not be statistically independent for their expected counts to add. What matters here is avoiding duplicate assignment of the same occurrence and using matching exposure and consequence definitions. Overlapping scenario lists require a valid partition or explicit overlap treatment before addition.

Reproduce the synthetic benchmark

1. IE-LINE: 0.12 × (1 − 0.90) × (1 − 0.70) = 0.0036 events/vessel-year.
2. IE-SEAL: 0.30 × (1 − 0.95) × (1 − 0.85) = 0.00225 events/vessel-year.
3. IE-HOSE: 0.08 × (1 − 0.85) × (1 − 0.60) = 0.0048 events/vessel-year.
4. Sum: 0.0036 + 0.00225 + 0.0048 = 0.01065 events/vessel-year. The largest base contribution is the hose-origin scenario, under these invented assumptions.
5. The rectangular-range lower corner is 0.00026 and upper corner is 0.1026 events/vessel-year. Their width reflects chosen input ranges, not a measured confidence level.

Uncertainty and dependency are part of the model

A point estimate hides uncertainty. Here low/base/high are authored scenario assumptions. They are not observed frequencies, Bayesian posterior summaries, distribution quantiles or a Monte Carlo calculation. Aleatory variability concerns event occurrence; epistemic uncertainty concerns imperfect information about parameters and model form. This worksheet only explores bounded parameter choices.

The all-low and all-high input vectors are not the minimum and maximum outcome vectors: success probabilities act in the opposite direction from initiating frequency. The displayed envelope uses the correct monotone corners. If shared evidence or physics correlates the uncertain parameters, those corners may be jointly infeasible. A full uncertainty analysis needs defensible joint distributions or constrained scenarios and a method for structural uncertainty.

Shared power, detection, crew actions, environment or maintenance may affect both isolation and fire prevention. Those effects must be represented consistently inside the origin- and history-conditioned values or through explicit linked failure models. This calculator does not estimate such values or verify dependencies. Giving the same barrier a second name does not create an independent protection layer.

The excluded multi-origin/common-cause initiators remain a missing contribution. Common causes within an included origin can still affect the response tree and must be represented in its conditional data. These are two different issues. Acknowledgment cannot repair missing evidence or a missing scenario.

Where the other methods fit

HAZOP structures the search for deviations; FMEA examines component failure modes; FTA can develop the failure logic of a response function; ETA organizes initiating-event sequences; LOPA evaluates explicitly defined protection-layer scenarios. A PSA integrates suitable models, evidence, dependencies, consequences and uncertainties to answer a defined safety question. Producing one product or a list of scores is not a complete PSA.

Primary method sources

NRC and IAEA sources address nuclear safety; NASA addresses aerospace/system risk. Only the general scenario, probability and dependency methods are transferred here. They provide no maritime approval, no marine failure data and no prescribed values for this example. All numbers, scenario names and diagrams are original teaching material.

• NRC · Probabilistic Risk Assessment
• NASA · Systems Engineering Handbook, 6.4 Technical Risk Management
• IAEA · SSG-3 (Rev. 1), 5.87–5.92: Analysis of Dependent Failures
• IAEA · Basic Professional Training Course, Module VII: Probabilistic safety assessment