Event tree — loss of cooling to an exothermic batch reactor

// Event tree analysis (ETA) — loss of cooling to an exothermic batch
// reactor. Read left to right: the initiating event frequency is split
// at each branch point by that branch's probability, and the outcome
// frequencies must sum back to the initiating frequency. They do:
//   9.0e-2 + 9.9e-3 + 9.9e-5 + 1.0e-6 = 1.0e-1 /yr
digraph eta_r301 {
  rankdir = LR;
  graph [fontname="Helvetica", fontsize=11, labelloc="t",
         label="Event tree — loss of cooling water, R-301 exothermic batch reactor (frequencies per year)"];
  node  [fontname="Helvetica", fontsize=10, shape=box, style=filled,
         fillcolor="#f8fafc", color="#475569"];
  edge  [fontname="Helvetica", fontsize=9, color="#475569"];

  IE [label=<<b>INITIATING EVENT</b><br/>Loss of cooling water to R-301<br/>during the exotherm<br/>f = 1.0e-1 /yr (plant records, 11 yr)>,
      fillcolor="#fee2e2", color="#b91c1c"];

  B1 [label=<BPCS high-temperature<br/>alarm TAH-301 and<br/>operator quench<br/><b>PFD 1.0e-1</b>>, fillcolor="#e0f2fe", color="#0369a1"];
  B2 [label=<SIF-301 emergency<br/>quench, SIL 2<br/><b>PFD 1.0e-2</b>>, fillcolor="#e0f2fe", color="#0369a1"];
  B3 [label=<Rupture disc RD-301<br/>to catch tank T-305<br/><b>PFD 1.0e-2</b>>, fillcolor="#e0f2fe", color="#0369a1"];

  O1 [label=<Batch quenched by the operator<br/><b>9.0e-2 /yr</b><br/>no loss of containment>, fillcolor="#dcfce7", color="#15803d"];
  O2 [label=<Batch quenched by SIF-301<br/><b>9.9e-3 /yr</b><br/>no loss of containment>, fillcolor="#dcfce7", color="#15803d"];
  O3 [label=<Runaway relieved to the catch tank<br/><b>9.9e-5 /yr</b><br/>contained release, plant damage>, fillcolor="#fef9c3", color="#a16207"];
  O4 [label=<Vessel rupture, toxic release<br/><b>1.0e-6 /yr</b><br/>potential on-site fatality>, fillcolor="#fee2e2", color="#b91c1c"];

  IE -> B1;
  B1 -> O1 [label="success  0.90"];
  B1 -> B2 [label="failure  0.10"];
  B2 -> O2 [label="success  0.99"];
  B2 -> B3 [label="failure  0.01"];
  B3 -> O3 [label="success  0.99"];
  B3 -> O4 [label="failure  0.01"];

  note [shape=note, fillcolor="#ffffff", color="#94a3b8", fontsize=9,
        label=<Tolerable frequency for a single on-site fatality: 1.0e-6 /yr.<br align="left"/>Outcome O4 sits on the criterion with no margin, so the SIL 2 claim on<br align="left"/>SIF-301 and its 12-month proof test are both safety-critical activities.<br align="left"/>Sum of the four outcome frequencies = 1.0e-1 /yr = the initiating frequency.<br align="left"/>>];
}