What is planning to ensure the continuation of operations in the event of a catastrophic event?

10.3.2 Active Preventive Barriers and Their Functions

The catastrophic event is avoided by detecting and avoiding failure or accident. Active preventive barriers follow the sequence Detect-Diagnose-Act and involve a combination of hardware, software and human action. Detection and monitoring is only part of the function. The collected/measured information needs to be processed and interpreted, after which an appropriate action must be taken. For example, a measured trend of increasing the temperature and the vibrations from a bearing indicates intensive wearout and incipient failure, which can be prevented by a timely replacement of the worn-out bearing.

4.22.4.3 Catastrophes

Although catastrophic events such as earthquakes and floods are inherently unpredictable, often their cumulative probability over decades can be calculated. Mount and Twiss (2005) estimated a two-thirds probability by 2050 of multiple failures among weakened levees in the California Delta, cutting off a water supply for about 23 million residents and about half of California s agriculture. This scenario is reminiscent of Hurricanes Katrina and Rita in the Gulf coast (Day et al. 2007) and the recent tsunamis in Indonesia (2010) and Japan (2011). The impact of catastrophes obviously depends on the particular characteristics of the estuary.

Catastrophic change may also occur when systems are pushed from one stable state into another. A slight change in salinity in a Danish fjord, caused by a decision to open a sluice gate to increase exchange with the ocean, transformed the estuary from a turbid state with high phytoplankton biomass to a clear state with numerous benthic filter-feeders (Petersen et al. 2008). Although examples of such apparently reversible state changes are uncommon, similar but irreversible state changes can accompany changes such as the spread of invasive species (see Section 4.22.4.2.5 Species Shifts (Figure 6).).

Disaster Events

While the potential for catastrophic events has always been present, anthropogenic climate change is resulting in the rise of extreme events, thus exacerbating the risk of environmentally initiated disasters. The growth of greenhouse gases in the atmosphere is leading to rising temperatures, including rising sea levels, changes in rainfall patterns, ocean acidification, and storm and cyclone events. These events are increasing the risk of disasters, such as bushfire, flood, storm and cyclone damage, and prolonged high temperatures. An Intergovernmental Panel on Climate Change (IPCC) report on extreme events notes that:

A changing climate leads to changes in the frequency, intensity, spatial extent, duration, and timing of extreme weather and climate events, and can result in unprecedented extreme weather

Allen et al. (2011, p. 5)

A natural disaster may also arise due to the length, repetition, and cooccurrence of climate events. For example, many parts of Asia (at the time of writing, May 2016) are subject to an extended drought. This event is currently encompassing New Guinea, Vietnam, Burma, and India (McDonald, 2016, p. 12). While each extreme climate event may result in a disaster, the combination of events, such as rising sea levels and storm activity, is also likely to compound the adverse impact on people and the environment, challenging resilience and a good recovery.

Repeated events were seen in Queensland, where severe flooding occurred over an extended time. The rain in December 2010 came after a wet spring and caused nine floods that affected almost 1,300,000 sq. km of land, caused billions of dollars in damage, led to the evacuation of thousands of people, and resulted in 35 deaths (University of NSW, 2012). Severe flooding and Cyclone Oswald occurred in late January 2013, flood waters peaking at 9.53 m in the town of Bundaberg, accompanied by a series of tornadoes (Daily News, 2013). Four deaths were recorded. The 2010–11 Queensland floods were attributed to a La Niña event that brought very heavy rain to the east coast of Australia. Work by the Bureau of Meteorology (2012) has shown that record high sea surface temperatures in October to December 2010 also contributed to the record rainfall.

The major reinsurance company, Munich Re, has documented the world trend in natural disasters (2016). While there is a fairly stable pattern of geophysical events from 1980 to 2015, there is a steady increase in other environmental disasters (storms, floods, drought, and fire) (Fig. 3.1). In addition to the increase in the number of events, their data reveals an increase in the impact of these events when the past 30 years is compared with the last 10 years (Höppe, 2015). Munich Re defines a catastrophic event as one which results in a direct insured loss to properties of US $25 million or more (2014 values). However, this definition is likely to underestimate the number and severity of events. In developing countries the rate of insurance uptake is less than in developed countries, but insurance uptake in a developed country may also not be high, with 30% of homes in the Victorian 2009 bushfire having no insurance cover. Floods resulting from a hurricane are not counted as this is not covered by insurance, and insurance does not include events that don’t involve property loss, such as the impact on people of a prolonged heat wave.

In the counted events, Munich Re measures the number of fatalities, overall losses, and insured losses. Thus, many of the impacts of a disaster remain uncounted, such as the number of physical injuries, which are often high, even in a developed country. In the first 72 h of the February 7, 2009, bushfires in Victoria, 414 people presented to hospitals, as a result of the fires (Cameron et al., 2009). Psychological injuries and stress reactions remain uncounted, as does loss of business revenue and the actual businesses. Indeed, many losses from disasters are not accounted for in many sources that estimate the cost of disasters. Also rarely mentioned is the reality that poorer people disproportionately experience natural disasters.

18.6.2 Possible Evolution in Safety Evaluation Methods (Mistakes and Limits in Probability Evaluations) and in Safety Criteria

The probability of a rare event may have been wrongly underevaluated for lack of information. Moreover, even if the probability of a rare event is correctly evaluated, and the return time of the event is long (e.g., 1000 years for a probability of once in 1000 years), usually most people think that a long time will in any case elapse before the event occurs. A kind of psychological phenomenon exists, which could be called “inverse mirage illusion” (what can be very near is perceived as being very far), by which events of very long return time are perceived as located in the far future. In reality, the definition of probability (ratio between a type of event and the total of possible events of any type) does not include any reference to the distance in future time of the event whose probability is calculated and the evaluated probability, again, is always an average probability over many return times (Moroney, 1951). Only in a time interval that is very long with respect to the evaluated return time will the interval between two successive events tend to be “on the average” close to the evaluated return time. This means that an event having a 1000 years return time may also happen next year. Something like that must have happened for the Fukushima tsunami.

Similarly, it is well known that in the “heads or tails” game a series, for example, of tails may happen instead of a regular alternating occurrence of “heads” and of “tails.”

The evaluated return time of rare events is an “average” value in very long times. On the contrary, the point in time when the event will happen is a product of chance or bad/good luck. Casual events, the product of chance, are defined by many experts as those events whose bases we do not know. Of course, according to this line of thought, causes exist for a rare event to happen sooner or later, but these causes are frequently not known.

If one looks at the action of choosing a coin in a coin box, one may consider that, for a blind extraction of a coin, the “head or tail” outcome will be casual. However, if the initial conditions of the operation are known (e.g., position of the coins and position of the hand), together with the velocity and direction of the hand movement and the rules followed for picking the coin from the box (e.g., the first coin touched by the hand is picked up without turning it), the outcome of the extraction could be precisely evaluated. The fact is that in the operation described just now, in most cases all these data are not known and the result has to be considered “casual” because of our ignorance. “Chance” is the great mysterious factor in future events, together with their probability.

The English philosopher John Locke said that men do not take their decisions in the sunshine of full knowledge, but in the crepuscule of probability. The presence of Chance is the cause of this belief.

However, in trying to understand whether a rare event may happen in a near time, the presence of every available indication of an imminent destructive event should be looked for and monitored. In this research the time interval is very important to which the word “imminent” is applied. As an example, it may be possible to make a forecast for a future period of many years (period of interest for nuclear plant design) and, on the contrary, it may not be possible to make a forecast for a future period of days (as it is of interest for preventive evacuation of population). In this respect, the correct question must be posed to experts in phenomena of interest, namely with the correct specification of the period of interest in the future. The problem is also that if the above-mentioned indications are available, often we do not believe in them or in their gravity (see the Vajont case, as an example).

Another possible pitfall in the practical use of probability evaluations is described in a recent publication of Nassim Nicholas Taleb, “The Black Swan” (Taleb, 2007). A Black Swan is, in brief, an isolated event of great impact which is not included in the realm of normal expectations, because nothing in the past may indicate, with a good degree of plausibility, its possibility to happen. The name “Black Swan” has been chosen because, before the discovery of Australia, the inhabitants of the Old World were convinced that all the swans were white. Prof. Taleb indicates, further, the existence, in the world of possibilities, two provinces: the Mediocristan and the Extremistan. The Mediocristan is the province dominated by mediocre events, where no single event may have a significant impact on the whole. The bell shaped, Gauss, probability distribution curve has its fundament in Mediocristan. The Extremistan, on the contrary, is the realm of Black Swans. Fig. 18.1 tries to show in a picture an example of the two types of events (intensity of events different by a factor of 100, LOG(100)=2).

The maximum probability densities of the two provinces are arbitrary. The variable might be the intensity of a damaging natural event or a financial crisis events (Prof. Taleb describes various cases of this kind as his main specialization is Finance). The approximate integral probabilities (1 and 5e-11) of the two classes of events are shown in the figure.

One of the most common misuse of probability distributions is to disregard the presence of Extremistan events besides events distributed in a more or less regular way, like along a Gaussian or similar curve of probability density.

Examples of initially (at least partially) disregarded events in the nuclear safety field are those listed at the start of Section 18.6.1.

Trying to imagine possible future catastrophic events of very low probability but still possible, the following cases could be figured as examples:

Another destructive tsunami. This phenomenon is particularly dangerous as it can start not only by an high-magnitude earthquake, but also from an undersea or coastal landslide or an undersea volcanic eruption or submarine explosion of other origin and because it propagates with damaging intensity for hundreds of kilometers or more.

A voluntary or accidental plane crash on a plant

A sabotage of the reactor protection systems

An explosion of a reactor pressure vessel or of another large plant vessel

Reactivity excursion due to a unborated plug in a PWR during a LOCA (possibility well known, for some PWRs, to thermal-hydraulic specialists)

Destructive tornado event on safety significant plants like the New Safety Confinement (Shelter) of the Chernobyl 4 Sarcophagus; the structure as it was publicly described years ago (Nuclear News, 2011 and later communications) is, indeed, a marvel of engineering for size and “lightweight” construction (29,000 t on a plan surface of 42,000 m2), but it is designed, as far as known, for a rather small tornado, while, in the geographical region of interest, higher intensity tornadoes have already happened (Petrangeli, 2011). However, it may well be that in recent times, the anchorage of the structure to ground has been reinforced and an improved venting system of the interior of the Shelter has been installed.

In this section, Black Swans are meant to include all “practically impossible,” yet “physically possible” events, also on the basis of past experience. These events fall, as for example the Fukushima event, outside the field of protection of the present five levels of Defense in Depth. Very exceptional provisions have to be adopted if an attempt to remove further the possibility of such events happening again is sought for. If we say that an event is “practically impossible” we cannot disregard it in this attempt.

The first requirement that seems necessary is that, once one of these events has happened or discovered in the past history, measures be taken on all other exposed plants in order to withstand it. Is a “sixth level” of Defense in Depth to be created in order to take care of these events?

Ideas for the definition of this “sixth level” are the following:

Try to discover precursor phenomena which announce an imminent disaster and keep them under observation (but this method is not usually precise enough concerning the identification of the time within which the phenomenon will happen);

Establish a warning system which can detect the already started natural and nonnatural phenomenon (e.g., tsunami, earthquake, suspect aircraft flights) and give some time (typical is a few minutes to 30 minutes) to put the plant in safe conditions (if possible, given its design features);

Design the plant against the “maximum possible event” whose magnitude can generally be better defined than the distance of the event in future time with respect to present (e.g., the maximum possible earthquake can be identified by the past history and by the tectonic features of the region). 10CFR Part 100, now Revised in 2017 (seismic and geologic siting criteria for nuclear power plants) was the first set of criteria which adopted this position. The absolute maximum earthquake in the world is generally accepted to have a Richter Magnitude of 8.5 to 9; for the L’Aquila, Italy, zone, the maximum possible earthquake could be of the order of M=7. Of course, the cost may be high. However, sites for nuclear plants are usually chosen in low seismicity locations (e.g., Appendix 16).

The choice of using for the plant design the maximum possible event, instead of an event of an estimated probability lower than a certain figure, could be extended to other potentially damaging events like floods.

In formulating new requirements, however, it must be remembered that, on the basis of past experience, sometimes a prevailing aversion from investment losses and from remedial expenses is evident in the behavior of some investors, even in presence of clear indications of an impending natural or machine-related catastrophe. This has been evident, for example, in the Vajont case (previous measured slow slide movement in Mount Toc which eventually developed into a fast disaster) and in the Fukushima case (previous tsunamis in the Indian Ocean).

One possibility to be discussed is to create for each nuclear plant or for a group of them a special fund for periodic plant or procedure modifications as a consequence of Black Swans in one plant. Further, always as an example to be discussed this fund could be created by saving one or two power operation days worth for each year of operation. The above used numbers take into account the observation that a Black Swan (list in Section 18.6.1) can be assumed, on the basis of experience, to take place roughly once in 10 years (Gianni Petrangeli, 2013) and that the improvement modifications on a plant may require an expense of tens of million euros or equivalent. This proposal means a kind of “self insurance.” Unconditioned new requirements and a change in mindset are, in any case, necessary.

Some examples of very exceptional provisions possibly required are mentioned below. Other and better provisions can be developed.

I am aware that these examples may be considered excessive and also counterproductive by somebody. Better solutions certainly exist, but my experience suggests that new good ideas, especially if costly, take time (10–20 years) to resurface after an initial neglect (I hope that this will not be the case in this moment). They usually are incorporated in new plant designs. Indeed, one current saying in industry is that “Every good new requirement is acceptable unless it changes the present established design” (intervention heard in an international congress). This position is understandable, unless an exceptional upgrade in safety level is requested by the available evidence, as, I think, in the present time.

The first example is a creation, even in an existing plant or in a plant under construction, of a new protection against aircraft crash, other impacts, inundation, or loss of other emergency electric power. This discussion proposal is roughly sketched in Fig. 18.2 and is more fully treated in (Petrangeli, 2013).

This additional protection consists of a reinforced or prestressed concrete cylinder surrounding the safety essential parts of a plant. As a protection against a destructive tsunami the cylinder could be 20–50 m high (see IAEA Guide SSG-18, which recommends a reference wave elevation over normal sea level of 50 m, in the absence of prevailing safe evidence). Fig. 18.2 shows a cylinder 120 m high (as much as a high nuclear or fossil-fueled plant chimney) which also acts as a protection against an aircraft impact (if the plant buildings were more embedded in the ground, the cylinder height could be lesser than 120 m). The impacting plane is assumed to touch the plant with a maximum angle with the horizon of 30 degrees (more than the exceptional angle of about 24 degrees attained by the plane hitting the Pentagon building in 2001) (Ritter, 2002) and much more than the usual landing angle of 3 degrees.

The upper part of the cylinder is covered by a steel cable grid and by a finer net, in order to offer protection against a variety of thinkable projectiles (drones, etc.).

In the upper part of the cylinder, an impact resisting segmented annular tank is located: it can supply cooling water to the core, in case of accident, for more than 4 days using as a driving force the hydrostatic pressure due to height (passive system).

The volume of the 120 m high cylinder is about 120,000 m2, costing more than 15 million euro.

Mobile water proof bulkheads have to be provided in the cylinder wall for the movement of components in and out of the cylinder. It is estimated that the external cylinder surface, if covered with solar cells, could provide several Mw of electric power in daylight. Other auxiliary systems will be required (power accumulators, etc.).

The plan shape of the cylinder may not be circular in order to adapt the structure to other nonsafety essential plant buildings.

If a solution like the one illustrated is adopted, the currently adopted antiaircraft protective features of the plant (shown in the Fig. 18.2) could be simplified for plants in the design stage with conomic advantage. If a steel containment is, then, used, also the containment cooling could be easier.

This solution, proposed as an example, may, again, seem excessive, as the first leak tight-pressure resisting containments of years 1960s seemed to many good common sense engineers. The opinion of these, however, radically changed after Three Mile Island.

Other examples of solutions are listed in (Petrangeli, 2013): plants built over an embankment (against tsunami) and passive emergency cooling systems (against loss of usual active emergency cooling systems).

Now available computer fluid dynamics codes can help in simulating with good accuracy a tsunami wave runup on a given terrain-plant situation (e.g., the effect of an embankmen as a plant elevated location over the surrounding ground).

Concerning the overall effectiveness of probability evaluations in nuclear safety analysis, the well-known fact has to be reminded that these evaluations are essential in the detection, in complex systems, of crucially important parts or phenomena. As an example, it is well known that a plant probability evaluation usually indicates that conditioning systems of equipment rooms are crucial to the operation of several safety systems and, therefore, their correct operation must be assured with an high probability by the usual means of quality level, redundancy, and diversification (see also Section 11.3).

Moreover, in the light of the discussion above, a low probability of intolerable events can be considered a necessary but not sufficient condition for the protection against such events.

6.2.1 Disaster recovery systems

As stated earlier, disasters are catastrophic events that occur unexpectedly in a random manner. They are either man-made, like terrorist attacks, or natural calamities, like earthquakes and tsunamis. The lack of infrastructure for disaster mitigation around the world and its prediction accuracy leaves civilians vulnerable to disasters. Disaster relief is an operation carried out after a disaster has occurred. A DRN is considered to be a life-saving network. The purpose of DRN is to provide emergency support to affected people and to support the crew members helping the victims. All existing networks were completely damaged in the areas that were affected by the recent incidents of Indonesia's tsunami in 2004, Hurricane Katrina in 2005, Japan's tsunami in 2011, the Haitian earthquake in 2010, and Hurricane Sandy in 2012. This rendered the crew members helpless, and many victims were trapped inside the disaster areas for a long time. There is now an increasing awareness among the government agencies for the need to implement disaster mitigation and relief systems.

Planning for disaster relief is a complicated operation that involves the use of proven technologies to coordinate, among several agencies, victims and crew members. A disaster can occur in any part of the world and no assumption must be made about any existing communication infrastructure in the disaster region. Therefore, DRN systems must be able to work autonomously, and if there is any communication infrastructure that exists before and after the disaster, then DRN must use and co-exist with such systems; this will expedite the disaster relief operation.

Since disaster relief is a life-saving operation, a DRN must be easy to deploy and operate, and it should require a short learning time by the disaster relief crew and victims in the affected area. With these basic requirements in mind, it is easy to see that wireless networks are the best choice for disaster relief operations because many of them do not require any pre-existing infrastructure to be established and are easy to operate. Several radio access technologies are currently available that can be used in cellular networks, wireless local area networks, wireless mesh networks, geographical area networks (GAN), unmanned aerial vehicles (UAV) and wireless personal area (WPAN) networks. Unfortunately, not all these technologies are directly applicable for DRN use because they are not designed for that purpose. However, several architectural solutions and protocols have been proposed and developed that use combinations of these existing technologies for partial disaster relief operations.

Introduction

Because the offshore industry has such a potential for catastrophic events, it is heavily regulated. Although regulations are often seen as being burdensome and onerous they do help ensure that safety and environmental standards are maintained and that all companies are held to the same level of performance. The existence of regulations is particularly important in those situations where a company may be tempted not to bother investing in safety. For example, a company that is attempting to wring the last drops of oil out a depleted well may have less enthusiasm (and funds) for implementing a full Safety Management System than it would were it drilling a new and large prospect. Regulations help prevent corner-cutting in situations such as these.

1 Introduction

The Indian Ocean Tsunami disaster was one of the most catastrophic events ever recorded (see also Chapter 1). Indonesia and Sri Lanka were the most affected countries, with the number of casualties exceeding 166,000 and 35,000, respectively.

After the tsunami both countries have made great efforts in terms of disaster response, relief, rehabilitation and reconstruction. However, as each country exhibited different damage patterns, and given the social and economic characteristics intrinsic to each of them, different reconstruction paths were chosen in each case. Nevertheless, the process of reconstruction after a large-scale disaster is often considered an opportunity to create a safer society, especially for developing countries.

In this chapter the reconstruction process, in terms of urban reconstruction, housing relocation and organizational rearrangement for disaster risk management after the disaster in Indonesia and Sri Lanka will be compared from the point of view of a “Build Back Better” philosophy (Davis et al., 2015), an idea which has recently become popular amongst the international disaster recovery community.

Publisher Summary

The development of safety systems is largely driven by lessons learned from incidents particularly catastrophic events. This chapter provides an overview of some of the incidents that led to the development of new offshore safety standards and techniques. Three of the incidents occurred onshore but their impact was so profound that they affected the entire energy-related business, regardless of location or industry type. (One of the offshore incidents—Blackbeard—was actually a nonevent, but it offers profound lessons to managers and leaders at all levels.) The importance of these events is not just to do with the loss of life and the environmental damage that was caused, but also in the lessons that can be learned from them. Three events from other industries are also described because of the impact they had on all industrial safety management programs.

Offshore pipelines are decommissioned at the end of its useful life or because of a catastrophic event such as a hurricane. In conventional operations, pipeline decommissioning is generally considered an inexpensive, low-tech activity, involving relatively simple procedures that are easy and quick to perform under normal conditions. This typically involves cleaning the line by pigging or flushing, cutting the pipeline endpoints, and then plugging and burying each endpoint below the seabed or covering with a concrete mattress. The vast majority of decommissioned pipeline in the U.S. Gulf of Mexico has been abandoned in place, but new regulations in designated significant sediment resource areas may require pipelines to be removed to avoid interfering with other uses of the Outer Continental Shelf. Factors that affect pipeline decommissioning and cost estimation examples conclude the chapter.

V.B Dams and Earth Retaining Structures

Failure of a dam, with rapid release of stored water, can be a catastrophic event. Fortunately, there were no earthquake-caused failures of large dams during the last half of the twentieth century, but there were two near misses and several failures of smaller dams. One near miss, near Los Angeles in 1971, spotlighted the susceptibility of earth dams constructed by hydraulic filling techniques. This event led to the development of techniques for analyzing such dams and to continuing efforts to upgrade the performance of existing dams constructed in that manner. Similarly, a near failure of a concrete arched dam in India in 1967 stimulated study of such dams. It is worthy of note that Pacoima Dam, a large arch dam near Los Angeles, has twice experienced very strong earthquake shaking without failure-threatening damage.

Walls to retain highway cuts and fills have generally performed well during earthquakes, unless there has been liquefaction-susceptible soil in the backfill or foundation. As might be expected, there have been widespread problems with retaining walls along rivers and especially in seaports because of liquefaction. Failures during many recent earthquakes have stimulated the use and development not only of techniques for in situ improvement of liquefaction-susceptible soils, but also of improved methods for analyzing and constructing retaining structures.