Use of Bayesian Networks in the risk analysis for an industrial plant :

1. Use of Bayesian Networks in the risk analysis for an industrial plant : Epistemological perspective of the modelling process of a system with technical and organisational dimensions Régis.Farret@ineris.fr (1) Jean-Christophe.LeCoze@ineris.fr Myriam.Merad@ineris.fr Carole.Duval@edf.fr (2) Aurelie.Leger@edf.fr (CRAN)(2), (3) (1) Institut national de l ’environnement industriel et des risques, France (2) EDF – Electricité de France, Research & Development, Dept MRI, France (3) Centre de Recherche en Automatique de Nancy, UMR 7039, CNRS-UHP-INPL, France

2. Other valves Inspection of valves Valve Toxic effects on population Toxic gaz dispersion Overpressure Thermic effect Vapour Cloud Explosion Training of drivers Other accident scenarios Fault tree + Event tree Manual or Organisational Ei 1 EI ET Ei 2 EI  Over-filling  OU EM Ei 3 Rise of pressure Ph D EI OU EM Vessel Rupture Ei 4 OU EM Ei 5 Ph D EI ET EM Physical Agression EC 6 EI OU  Vehicle accident  Ein 7 EI OU EC 8

3. Modelling Approach Uncertainty Decision making Bayesian Network (BN) The frame of our project > Our epistemological questions 2. Should a model be a faithful image of reality ? 3. Are we confident in the results ? 1. What is the goal of the modelling process ? • 4. What types of • uncertainties : • are we faced with ? • can we estimate ? Risk Analysis Organisational Analysis 5. Does the expert influence the model ? The results ? 6. What are the (expected) advantages of this BN tool ? What are its limits ?

4. * Set of elements linked together in order to achive a goal* System > Sum (elements) Interaction with the envt, yet the model-ling process has to set boundaries * «cum plexus» = bound with* «Organised complexity» (Weaver, 47):auto-org°, feed-back, reconfiguration* e.g. engine failure < living organism WHAT ? The system studied • Industrial equipment / installation • Technical • Human and organisational • Open • Complex • Dynamic • Objective : • help optimum decisions ensuring security • Examples of practical questions: • Estimate the efficiency of a safety barrier, including all human and organisation  probability of 1 accident • Choose between 2 safety barriers (human / technical) • Estimate the impact of one change in the organisation  probability of various accidents

5. A model is a representation of reality, in order to help in a decision or answer a specific question It is NOT a faithful image of reality - necessarily simplified (esp. for complex system) - drawn from a given point of view « The map is not the territory » WHY ? The objectives of modelling • Risk analysis is a particular case of modelling • 1. Identification of risks What can go wrong ? • 2. Characterisation of risks How often (how likely) ? •  If it goes wrong, what consequences ? • 3. Interpretation / Decision+ How confident am I in the result ? • Describe (represent) • Understand • Predict • Decide (or communicate) P G Uncertainty

6. HOW ? (1) Our global modelling process Technical Organisational Expertise Expertise A. Definition of system + question Building the model B. Risk Identification C. Audition of operators Risk Analysis = Modelling D. Representation Quantifying E. Risk characte-risation (quantif.) F. Décision

7. HOW ? (2)(A priori) Interest of Bayesian Networks • 1. Graphical (representation & communication, easy to handle) • 2. Probabilities included • Generalise the concept of Fault / Event Tree, with probabilistic links (influences) between variables (various “states”) > deterministic tree Other advantages : • Integrate figures / expert advice • Integrate (partially) correlated links • Possibility of dynamic networks • Integrates uncertainty through probabilities, as a mean of expressing both 1°) our ignorance and 2°) our knowledge

8. (A priori) interest of Bayesian Networks : an example Thermic effect Cigarette Fire in the building Non application of security rules Presence of fuel Toxic effect High temperature outside Probabilistic link Deterministic link

9. Uncertainty (1) : a typology • No absolute classification of uncertainty is established • Most known typology : • Variability(stochastic, objective) = intrinsic property of reality • Epistemologic(lack of knowledge, subjective) = depends on us ! • structural : ignorance of phenomena • choice of tool, model, method of audition / analysis • lack of data + difficulties of observations/measurement • Our proposal (adapted to our system + our approach) • Building the model • Quantifying

10. Uncertainty : typology Modelling Rules for risk analysis + building the model Quantification Integration of proba + uncertainty by the B.Network

11. Uncertainty : towards a strategy • Two main ways of tackling uncertainty : • Develop social/political strategy to : • live with uncertainty : e.g. precaution principle • manage uncertainty : e.g. choice of acceptability criteria  outside our scope • Develop better tools to know better : • Get more data / more precise data  outside our scope • Quantifying :  Improve estimation (quantification), through B.N. • Building the model (risk analysis + building the model) :  conceptual frame + guidance + « validation » by experts • Another human source of uncertainty : subjectivity • No analysis is possible without a sequence of (small) decisions based on the analyst ’s judgement • All the more so in the human/organisational field ! • NB : the analyst is NOT part of the system, but influences the observation/modelling process

12. Our conceptual frame Level 3 : organisational(management, envtal factors) Level 2 : human (individual actionsor decisions) Level 1 : technical (bow-tie from risk analysis)

13. (A posteriori) Interest of Bayesian Networks • 1. Graphical (representation & communication, easy to handle) • 2. Probabilities included in a rigourous way • Generalise the concept of Fault / Event Tree, • with probabilistic links (influences) between variables (various “states”), • which can express uncertainty and be integrated instantaneously • Main limits and specific recommendations • Specify the system boundaries & precise objective of the study (question ?) • Be aware that model = support for reasoning (e.g decide), NOT reality • Avoid too complicated graphs • Conceptual frame + Procedure (included a specific « protocole ») = build the model + manage the related uncertainty • 2 experts : both technical + organisational competences • Legitimation step : conceptual frame + approbation by a working group • Open questions : • How to limit subjectivity ? How to transfer natural language into probabilistic figures ? (identify scales, objective criteria…) • Is it legitimate to translate organisational influences into numbers ? • Is it useful to develop 3 BN for the 3 levels of our conceptual frame ?

14. Thank you for your attention Régis.Farret@ineris.fr (1) Jean-Christophe.LeCoze@ineris.fr Myriam.Merad@ineris.fr Carole.Duval@edf.fr (2) Aurelie.Leger@edf.fr (CRAN)(2), (3) (1) Institut national de l ’environnement industriel et des risques, France (2) EDF – Electricité de France, Research & Development, Dept MRI, France (3) Centre de Recherche en Automatique de Nancy, UMR 7039, CNRS-UHP-INPL, France