The question it answers
The central question is what may happen after an event, such as a loss of cooling or a spill. INSST Technical Note NTP 328 describes an inductive technique examining safety functions and circumstances that alter the course of events.
It differs from a fault tree, which seeks combinations capable of causing an event, and from a cause tree used to investigate events that have occurred. These tools complement one another.
Defining the initiating event and scope
The initiating event must be described precisely: what happens, where, under which conditions and during which operation. Combining very different scenarios into one event makes consequences and their data difficult to interpret.
Analysis requires knowledge of the process, incident experience and existing safety functions. Personnel familiar with operations, maintenance and design should participate. An incomplete list of initiating events excludes scenarios even if the trees included are calculated correctly.
Ordering responses and building branches
Relevant functions and circumstances are identified in sequence: detection, response, containment or other conditions affecting the outcome. Each branch point represents clearly defined alternatives, usually success or failure.
What success means must be specified. An alarm sounding when nobody can respond in time does not fulfil a function requiring human intervention. Nor should branches be added if they do not change the outcome of the sequence being analysed.
Probabilities and frequencies
At each node, the alternatives must cover the outcomes considered and their probabilities sum to one. A sequence’s frequency is obtained by multiplying the initiating-event frequency by the conditional probabilities along its branches.
Data must state their source, conditions and limitations. If two barriers share power, a sensor or maintenance, independence cannot be assumed without justification. Conditional probabilities can represent how a response changes after preceding events.
Interpreting results without false precision
Sequences end in described states and, where appropriate, quantified consequences. Check that no outcomes are missing and that the sum of final frequencies equals the initiating-event frequency within the model.
IEC 62502:2010 addresses qualitative and quantitative event tree analysis. The technique does not turn approximate data into certainty or determine by itself whether a risk is acceptable.
Review, dependencies and use
The tree should be reviewed by people familiar with the process who did not build the model. Look for omissions, common-cause failures, unrealistic human responses and changes in conditions.
The result supports scenario comparison and identification of important barriers within a broader assessment. It must be reviewed if equipment, organisation or reliability data change. A barrier’s presence in documentation does not demonstrate that it is installed, maintained and operational.
Hypothetical numerical example
A teaching model assumes an initiating event with a frequency of 0.1 per year. The first response has a failure probability of 0.10. If it fails, a second response has a conditional failure probability of 0.20.
The double-failure sequence is therefore 0.1 × 0.10 × 0.20 = 0.002 per year. The other frequencies are 0.09 and 0.008; all three sum to 0.1. These figures are invented to explain the calculation, not design values or evidence that an installation is acceptable.
