University of Southern California Dissertations and Theses

Interdependency of the water-oil-nuclear industries in the Persian/Arabian Gulf: understanding risk and improving prevention and preparation of disasters

(USC Thesis Other)

Interdependency of the water-oil-nuclear industries in the Persian/Arabian Gulf: understanding risk and improving prevention and preparation of disasters

PDF

Download a page range

Download transcript

Copy asset link

Request this asset

Transcript (if available)

Content

Interdependency of the Water-Oil-Nuclear Industries in the Persian/Arabian Gulf:
Understanding Risk and Improving Prevention and Preparation of Disasters

By

Ghena Alhanaee

A Dissertation Presented to the
FACULTY OF THE USC GRADUATE SCHOOL
UNIVERSITY OF SOUTHERN CALIFORNIA
In Partial Fulfillment of the Requirements
for the Degree
DOCTOR OF PHILOSOPHY
CIVIL ENGINEERING

December 2020

Copyright 2020 Ghena Alhanaee
ii

ACKNOWLEDGMENTS

It is my pleasure to express appreciation and acknowledgment of several individuals who played
an instrumental role in the completion of my PhD research.

Firstly, I would like to express my deep and sincere gratitude to my Doctoral Advisor, Prof.
Najmedin Meshkati. I remain indebted to him for his careful supervision, generosity, patience,
encouragement and thoughtful guidance throughout my research. I am grateful for his willingness
to always listen to and discuss my thoughts and ideas, his enthusiasm and excitement amidst every
achievement, and his wise guidance and diligence efforts throughout the years. I am eternally
grateful to have spent time under his supervision.

I would also like to express my gratitude to my PhD Dissertation Committee Members; Prof. Sami
Masri, Prof. Kelly Sanders, and Prof. Jeff Nugent.

Prof. Sami Masri was instrumental in welcoming me to the University of Southern California,
generously spending time to introduce me to the Sonny Astani Department of Civil and
Environmental Engineering. He was the key person who encouraged me to pursue a research topic
of my interest and facilitated me doing so. I am deeply grateful for his generosity and guidance.

Prof. Kelly Sanders has always led by example in her scholarship and commitment to students. I
am very grateful for the guidance and encouragement I have received from her throughout my
research. I feel very blessed to have also taken a class from her which inspired me greatly and was
a catalyst for much of my thought process in this research.
iii

Prof. Jeff Nugent has graciously spent time guiding and encouraging me throughout my research
and giving me valuable advice on strategies for regional cooperation, collaboration and economics.
I am very grateful for his guidance as my external committee member.

I am grateful to the Sonny Astani Department of Civil and Environmental Engineering for
providing an environment where I could learn and grow.

In addition, I am very thankful to Dean Yannis Yortsos, Dean of the Viterbi School of Engineering,
who was always very encouraging and supportive of my work.

I am grateful to Prof. Mohammad Modarres, Director of the Nuclear Engineering Program and
Director of the Center for Risk and Reliability at the University of Maryland, who kindly spent
time discussing our research and providing guidance and advice. His extensive work in the nuclear
industry and multi-unit dependencies at nuclear power plants, served as a foundation of our work
to expand these dependencies further into multi-industry analysis.

I am grateful to all the industry and research experts who guided us throughout this research and
provided their expert insight and advice, some of which remain anonymous, and some of which
include:

• Mr. Bob Coovert, who held several training roles at the Institute of Nuclear Power
Operations, supported domestic and international industry inspections with WANO and
iv

INPO and led and participated in over twenty IAEA missions as an expert in
Organizational, Human Performance, Causal Analysis and Knowledge Management.
• Dr. Chuck Casto nuclear and safety regulatory professional with 38+ years of experience
in the NRC, who led the integrated US government and NRC efforts in Japan following
the Fukushima nuclear accident, and received the Presidential Distinguished Award from
President Obama in 2012.
• Mr Earl Carnes, Senior Advisor for Human and Organizational Factors, US Department of
Energy.
• Mr. Ed Greenman, USNRC retired member of the senior executive service, IAEA senior
expert and Eagle Research Group consultant for the US Department of Energy.
• Dr. Kenneth Koves, Senior Advisor for Safety Culture and Leadership Development, the
World Association of Nuclear Operators (WANO) Tokyo Center; former principal
program manager in Industry Leadership at the Institute for Nuclear Power Operations
(INPO)
• Miroslav Lipar, Nuclear Safety Senior Consultant and Former Section Head of Operational
Safety at IAEA.
• Dr. Rick Hartley, distinguished expert in high reliability organizations, culture, incident
investigation and analysis.
• Professor Zahra Mohaghegh, Nuclear, Plasma & Radiological Engineering, Director of the
Socio-Technical Risk Analysis (SoTeRiA) Research Laboratory, University of Illinois

I am also grateful to Prof. Maryam Tabibzadeh, Manufacturing Systems Engineering, California
State University – Northridge, who kindly advised me, specifically with regards to the oil industry,
v

evaluating risk and reliability, and application of methodologies. I am grateful for her
encouragement and support.

I would like to acknowledge Daniel Druhora, senior digital content producer at the Viterbi
Communications and Marketing Group who was the key point of contact for media
communications, press releases and articles in recognition of this research work and the awards it
received. I am very thankful to Daniel for all the time he spent discussing our work, creating
content, facilitating media communications, as well as his genuine interest and encouragement of
our work and contributions.

I am grateful to the Viterbi Admissions and Student Engagement (VASE) Office where I served
as Viterbi Graduate Student Liaison for 3 years, for the wonderful environment they fostered and
their incredible work in support of their students at the Viterbi School of Engineering.

I am also grateful to the senior representatives from entities in UAE, including ADNOC, FANR
and ENEC who encouraged our research efforts.

I remain eternally grateful to my family for always valuing academics and the pursuit of
knowledge, for all their encouragement and support throughout the years, empowering and
encouraging me to pursue higher education, and helping to facilitate my studies over the last
several years.

vi

TABLE OF CONTENTS

Acknowledgements.........................................................................................................................ii
List of Tables.................................................................................................................................vii
List of Figures.................................................................................................................................ix
Abstract ........................................................................................................................................xiii
Chapter 1: Introduction....................................................................................................................1
Chapter 2: Oil and Gas in the Gulf .................................................................................................5
Chapter 3: Nuclear Power in the Gulf ..........................................................................................10
Chapter 4: Desalination in the Gulf…….......................................................................................17
Chapter 5: Climate Change in the Gulf ........................................................................................22
Chapter 6: Multi-Industry Dependencies (Expansion of Modarres and Schroer’s Work) ...........25
Chapter 7: Classification Schema for Analysis of Multi-Industry Events....................................37
Chapter 8: Methodologies for Risk Analysis................................................................................58
Chapter 9: Categorizing Data and Identifying Severity in Offshore Oil Platforms......................70
Chapter 10: Extension of Risk Analysis for Offshore oil Operations...........................................83
Chapter 11: Categorizing Data and Identifying Severity in Nuclear Reactors...........................113
Chapter 12: Risk Analysis in Nuclear Reactors..........................................................................119
Chapter 13: Multi-Industry Risk Analysis Framework...............................................................158
Chapter 14: A Regional Framework for Multi-Industry Cooperation in the Gulf......................169
Chapter 15: Conclusion and Recommendations..........................................................................177
Bibliography................................................................................................................................184
Appendices...................................................................................................................................192

vii

LIST OF TABLES

Table 2.1 Oil Production Statistics in the Gulf................................................................................6
Table 2.2 Natural Gas Production in the Gulf.................................................................................6
Table 4.1 Desalinated Drinking Water Percentages in the Gulf....................................................17
Table 4.2 Desalination Plants in the Gulf......................................................................................19
Table 9.1. Summary of BSEE Data on Incidents in Offshore Oil Platforms in the OCS..............71
Table 9.2. Example of Categorization of Collision Incidents (BSEE, 2020) ...............................72
Table 9.3. Summary of Consequence Severity of Collision Incidents..........................................73
Table 9.4. Summary of Consequence Severity of Evacuation & Muster Incidents......................74
Table 9.5. Summary of Consequence Severity of Fatality Incidents............................................74
Table 9.6. Summary of Consequence Severity of Fire and Explosion Incidents..........................75
Table 9.7. Summary of Consequence Severity of Gas Release Incidents.....................................76
Table 9.8. Summary of Consequence Severity of Loss of Well Control Incidents.......................77
Table 9.9. Summary of Identified Potential Multi-Industry Events..............................................78
Table 9.10. Potential Multi-Industry Risk for Collision Data.......................................................79
Table 9.11 Potential Multi-Industry Risk for Fire Data.................................................................81
Table 10.1 Potential Multi-Industry Event....................................................................................83
Table 10.2 Probability of primary events......................................................................................87
Table 10.3 Basic Event Probabilities.............................................................................................89
Table 10.4 Probabilities of Intermediate Events............................................................................89
Table 10.5 Fault Tree Event References........................................................................................90
Table 10.6 Minimal Cut Sets Identified.........................................................................................92
Table 10.7 Minimal Cut Sets Identified.........................................................................................92
viii

Table 10.8 Breakdown of Categories for Safety Supervision Bayesian Network.........................99
Table 10.9 Probability Tables for Six Parent Nodes in Safety Supervision Network.................100
Table 10.10 Probability Table for Leadership Enforcement.......................................................100
Table 10.11 Probability Table for Leadership Enforcement.......................................................100
Table10.12 Probability Table for Leadership Enforcement........................................................101
Table 10.13 Probability Table for Complacency.........................................................................101
Table 10.14 Probability Table for Fatigue...................................................................................101
Table 10.15 Probability Table for Worker Morale......................................................................102
Table 10.16 Probability Table for Safety Supervision................................................................103
Table 10.17 Breakdown of Categories for Bayesian Belief Network.........................................109
Table 12.1 Reactors by Region....................................................................................................120
Table 12.2. Summary of 50.73a2v(B) events during Cold Shutdown in Fort Calhoun..............128
Table 12.3. Probability Distribution Tables for Engineering Rigor Bayesian Belief Network
Analysis........................................................................................................................................132
Table 12.4 Summary of Human Error Licensee Event Reports..................................................139
Table 12.5 Summary of Human Error Licensee Event Reports for Diablo Canyon...................142

ix

LIST OF FIGURES

Figure 1.1 Map of the Persian Gulf.................................................................................................1
Figure 2.1 First Discoveries of Oil in the Middle East....................................................................5
Figure 2.2 Map of the Gulf and Petroleum Infrastructure...............................................................7
Figure 2.3 Strait of Hormuz Oil Chokepoint ..................................................................................8
Figure 2.4 Non-Oil GDP .................................................................................................................9
Figure 3.1 Nuclear Power Plants in Iran........................................................................................10
Figure 3.2 UAE Generation Capacity and Projected Demand......................................................11
Figure 3.3. Location of Selected Nuclear Reactor Site.................................................................13
Figure 3.4 Nuclear Reactor Projections in the Gulf......................................................................15
Figure 4.1 Desalination Capacities of Countries Around the World.............................................18
Figure 5.1 Temperature Projections in Southeast Asia.................................................................22
Figure 6.1 Multi-Industry Impact – Venn Diagram......................................................................26
Figure 6.2 Cause-and-Effect Diagram for Multi-Industry............................................................28
Figure 6.3 Human Influence Categories for Multi-Industries.......................................................31
Figure 6.4 Organizational Influence Categories for Multi-Industries...........................................34
Figure 7.1 Event Report Breakdown for Data Analysis................................................................39
Figure 7.2 Yes/No logic for the potential of physical proximity...................................................42
Figure 7.3 Yes/No logic for the potential of a shared connection ................................................42
Figure 7.3 Life & Health Consequence Categories for the Oil Industry.......................................44
Figure 7.4 Economic Consequence Categories for the Oil Industry.............................................45
Figure 7.5 Environment Consequence Categories for the Oil Industry.........................................46
Figure 7.6 Unavailability Consequence Categories for the Oil Industry.......................................46
x

Figure 7.7 Extension of Severity Classification for NRC Licensee Event Report........................49
Figure 8.1 Fault Tree Event Symbols............................................................................................59
Figure 8.2 Fault Tree Gate Symbols (Ramana, 2020) ..................................................................59
Figure 8.3 Fault Tree Example for Event A..................................................................................60
Figure 8.4 Minimal Cut-set Fault Tree Example for Event A.......................................................63
Figure 8.5 Bayesian Network Example.........................................................................................64
Figure 8.6 Hybrid Causal Logic System Example.........................................................................68
Figure 10.1 Fault Tree for Gulf of Mexico Blowout July 23
rd
2015............................................88
Figure 10.2 Sensitivity Analysis – Poor Safety Supervision and Blowout....................................94
Figure 10.3 Sensitivity Analysis – Insufficient Safety Checks and Blowout................................95
Figure 10.4 Sensitivity Analysis – Knowledge and Blowout........................................................95
Figure 10.5 Fault Tree Snapshot...................................................................................................97
Figure 10.6 Bayesian Belief Network for Safety Supervision......................................................98
Figure 10.7 Bayesian Belief Network for Safety Supervision.....................................................104
Figure 10.8 Bayesian Belief Network for Safety Supervision with Evidence of Strong
Management Commitment to Safety...........................................................................................105
Figure 10.9 Bayesian Belief Network for Safety Supervision with Evidence of Strong
Management Commitment to Safety and Weak Leadership Enforcement..................................106
Figure 10.10 Insufficient Safety Check Element – Fault Tree Snapshot.....................................107
Figure 10.11 Bayesian Belief Network for Insufficient Safety Check........................................108
Figure 10.12 Bayesian Belief Network with Probabilities..........................................................109
Figure 10.13 Bayesian Belief Network with evidence of 12+ hour shift....................................110
xi

Figure 10.14 Bayesian Belief Network with evidence of a 12+ hour shift and Negative Co-
worker Influence..........................................................................................................................111
Figure 11.1 Severity Categorization of PWR LERs between Jan 1
st
2010-2020.......................115
Figure 12.1 U.S. NRC Regions Map...........................................................................................119
Figure 12.2 Number of LERs by Region between Jan 1
st
2010-2020........................................120
Figure 12.3 Average Number of LERs per Reactor by Region between Jan 1
st
2010-2020......121
Figure 12.4 Number of PWR LERs in High Severity Categories...............................................122
Figure 12.5 Average Number of PWR LERs in High Severity Categories per PWR.................123
Figure 12.6 Distribution of PWR LERs in High Severity Categories for Region IV..................124
Figure 12.7 Distribution of PWR LERs in Region IV Reactors for Criteria 50.73a2v(B) .........125
Figure 12.8 Distribution of PWR LERs in Region IV Reactors for Criteria 50.73a2v(D) .........126
Figure 12.9 Categorization of Fort Calhoun LERs 50.73a2v(B) by Operating Mode................127
Figure 12.10 Identified causes associated with 50.73a2v(B) events during Cold Shutdown in Fort
Calhoun........................................................................................................................................130
Figure 12.11 Contributing Causes towards Identified Event Cause of Insufficient Engineering
Rigor............................................................................................................................................131
Figure 12.12 Bayesian Belief Network Example for Engineering Rigor....................................133
Figure 12.13 Example of Evidence of Strong Competency and Oversight with High
Complacency................................................................................................................................134
Figure 12.14 Introduction of Additional Relationship between Oversight and Complacency....134
Figure 12.15 Updated Probability Distribution with Additional Relationship between Oversight
and Complacency.........................................................................................................................135
Figure 12.16 Evaluation of Complacency and its Contributing Factors......................................137
xii

Figure 12.17 Human Error LERs by Region...............................................................................141
Figure 12.18 Human Error LERs by Plant...................................................................................141
Figure 12.19 Human Performance Improvement Model.............................................................144
Figure 12.20 Open Systems Model..............................................................................................145
Figure 12.21 Contributing Causes to Event Report 275-2011-005.............................................146
Figure 12.21 Contributing Causes to Event Report 275-2011-006.............................................148
Figure 12.22 Contributing Causes to Event Report 275-2011-007.............................................149
Figure 12.23 Contributing Causes to Event Report 275-2011-008.............................................150
Figure 12.24 Contributing Causes to Event Report 275-2013-001.............................................151
Figure 12.25 Contributing Causes to Event Report 323-2013-003.............................................152
Figure 12.25 Contributing Causes to Event Report 323-2019-001.............................................153
Figure 12.26 Collation of Human Error Licensee Event Report Results....................................154
Figure 12.27 Example Bayesian Belief Network through Expert Review of Human Factor Events
in diablo Canyon..........................................................................................................................155
Figure 13.1 Multi-Industry Dependency Categories...................................................................160
Figure 13.2 Schematic of Multi-Industry Interdependency Analysis..........................................162
Figure 13.3 Schematic of Multi-Industry Risk Elements............................................................167
Figure 14.1 Regional Collaboration and Cooperation among surrounding Gulf countries and
multi-industries............................................................................................................................171
Figure 14.2 Multi-Country and Multi-Industry Risk Analysis Framework ...............................172
Figure 14.3 Bow-tie diagram for multi-industry.........................................................................174

xiii

ABSTRACT

The Arabian/Persian Gulf (the “Gulf”) is a unique and critical body of water. Home to over 150
offshore oil rig platforms, the highest density in the world, and with roughly 70% of the world’s
desalination capacity located in this small body of water, the role that the Gulf plays both
regionally and globally is a critical one. Over recent years, surrounding countries have embarked
on introducing nuclear power to their energy supply to diversify their economies and reduce their
dependency on oil. Current projections estimate that the Gulf could have as many as 20+ nuclear
reactors in the region by 2030.

The unique combination and concentration of these three major industries (desalination, oil, and
nuclear) in the Gulf introduces a complex set of vulnerabilities and dependencies to each other, as
they all share the same body of water for their operations. These industries work independently of
each other; however, they are inherently interdependent.

We attempt to introduce a framework that evaluates these interdependencies and links these three
industries and their operations, to facilitate the sharing of data, risk mitigation practices, and timely
response strategies. Subject to the rules and regulations in the Gulf, a limitation of the research
work is the restricted access to data in the Gulf, and therefore, to overcome this limitation, publicly
available data from the U.S., specifically the Bureau of Safety and Environmental Enforcement
(BSEE) and the Nuclear Regulatory Commission (NRC) is used in order to present technical
analysis of incidents that have been reported to these entities at both nuclear and offshore oil
facilities in the U.S.

xiv

Past incidents that occurred between 2010 and 2020 were evaluated and methodologies presented
to categorize data into severity and consequences. The methodologies chosen include fault tree
analysis, and Bayesian belief networks, since these tools were identified to be relatively simple,
user-friendly and allow for the implementation of dissimilar information e.g. both qualitative and
quantitative data. Applications of these methodologies and integration of this analysis is presented
to introduce an inter-connected framework for cross-industry collaboration as well as regional
collaboration.
1

Chapter 1

Introduction

The Arabian/Persian Gulf, hereafter referred to as the Gulf, has quickly emerged as a global
hub for trade, tourism and transport. Surrounded by eight countries (Iran, Iraq, Kuwait, Saudi
Arabia, Qatar, Bahrain, UAE, and Oman), this region plays a critical role in the production and
supply of oil and gas. With a length of 615 miles and an average depth of 164 feet, the Gulf has a
single opening to the wider ocean
known as the Strait of Hormuz, which
is only about 35 miles wide. For
perspective on size, this enclosure is
roughly half the size of the State of
California. The country Bahrain is
smaller than the city of Los Angeles.
With a surface area of ~93,000 mi
2
, the
Gulf water represents a mere 0.067%
of the world’s total water surface area
estimated at 139.4 million mi
2
(Evans,
2020).
The boom of oil and subsequent population growth has led to an extreme dependency on
this commodity. Several of these surrounding countries including Saudi Arabia, UAE and Qatar
have become some of the top oil and gas producers in the world (Energy Information
Administration, 2020).
Figure 1.1 Map of the Persian Gulf (OnTheWorldMap, 2020)

2

However, taking a closer look reveals another dependency, perhaps a much more stark and
vital one: water. Due to its geographical location and minimal rainfall, surrounding countries
depend heavily on the Gulf for clean water through desalination. Despite the Gulf’s water surface
area representing less than 0.1% of the world’s water surface area, 2015 data shows that roughly
70% of the world’s desalination capacity is located in this small body of water (USGS, 2020).
Qatar, for example, sources over 99% of its drinking water from desalination of the Gulf water
according to a study published in 2012, and even more alarmingly, only has enough water in
storage for 48 hours in the case of an emergency (Bachellerie, 2012).
The continued upward trend in population growth has also led surrounding countries to
consider alternative forms of energy to meet growing population demands. UAE and Saudi Arabia
have decided to introduce nuclear power to their market, while Iran has decided to grow their
already existing nuclear power industry further. This rapidly emerging industry adds another
complex layer to the already critical interdependency of the two major industries: oil and
desalination. The Gulf is currently home to only one nuclear reactor located in Bushehr, Iran, but
projections bring that figure to as many as 20+ nuclear reactors by 2030.
The unique combination, concentration and high density of these three major industries
(desalination, oil and nuclear) in the Gulf introduces a complex set of vulnerabilities and
dependencies to each other. They all inherently share the same lifeline of the Gulf water for each
of their operations resulting in a highly coupled (or perhaps a more appropriate term: tripled)
system that cannot be de-coupled.
However, even though these industries are inherently interdependent as they share the same
body of water, they each work independently of each other.
3

An incident occurring in one of these industries at the scale of Fukushiima or BP Deepwater
Horizon would unquestionably have devastating consequences, not only impacting the energy
industry, but also impacting the single main source of drinking water for the surrounding countries.
In addition to the impact on surrounding countries, the safety and sustainability of the Gulf has
serious global implications. At the end of 2018, proven crude oil reserves in the surrounding
countries constituted 51.2% of the world’s reserves (OPEC, 2019).
In 2018, the Honorable Dr. Richard Danzig, Former Secretary of the Navy and Senior
Advisor of the Johns Hopkins Applied Physics Laboratory, published a report on Technological
Superiority in the USA (Danzig, 2018), and one statement rings very true to the research we will
be addressing in this paper:

The significance of this research project is to evaluate the interdependencies of the three
major industries in the Gulf (oil, nuclear and desalination), and introduce a framework for analysis,
as a means to minimize and mitigate the occurrence and the consequences of a large-scale event,
by being pro-active and not re-active.
4

Chapters 2, 3, 4 will provide an overview of the three industries’ operations in the Gulf,
with Chapter 5 touching upon the implications of climate change in conjunction with the
industries’ operations. Chapters 6, 7, and 8 will discuss methodology of analysis and categorization
of data, with the limitations and constraints of the project highlighted in Chapter 7. Chapters 9, 10,
11 and 12 present examples of analysis and application of methodologies, with Chapters 13 and
14 presenting a proposed framework of analysis linking the three industries and the surrounding
countries in the Gulf.

5

Chapter 2

Oil and Gas in the Gulf

1908. Oil was discovered in
Iran. This led to a series of exploration
initiatives that catapulted the region
into unprecedented wealth and
infrastructure development, as a result
of the subsequent discoveries of oil in
Iraq in 1927, Bahrain in 1932, Kuwait
and Saudi Arabia in 1938, Qatar in
1940, UAE in 1953 and finally, Oman
in 1956 (Sorkhabi, 2010).
These discoveries were a turning point for the region, substantially increasing its perceived
geo-political importance to the international community by creating a global dependence and
reliance on the region for energy security.
As of January 2018, there were 1,322 offshore oil rigs globally with 159 located in the
Gulf, the highest density in the world (Statista, 2019). Proven crude oil reserves in the surrounding
Gulf countries amounted to 51.2% of the world’s reserves at the end of 2018 (OPEC, 2019).
In 2019, according to OPEC, the breakdown of oil production (crude oil, petroleum liquids
and biofuels) in the Gulf constituted nearly one-third of total world production, with the breakdown
of shares by country presented in Table 2.1.
Figure 2.1 First Discoveries of Oil in the Middle East
(Sorkhabi, 2010)
6

Table 2.1 Oil Production Statistics in the Gulf
Country Oil Produced (MBPD) Share of world total (%)
Iran 3.19 3.2%
Iraq 4.74 4.71%
Kuwait 2.94 2.92%
Saudi Arabia 11.81 12%
Bahrain 0.055 .05%
Qatar 2.0 2%
UAE 4.02 4%
Oman 0.98 0.98%
Total 29.74 29.86%

As for the breakdown of natural gas production in the Gulf, 2018 statistics depict the
following distribution in the Gulf (Statista, 2020):
Table 2.2 Natural Gas Production in the Gulf
Country Natural Gas Produced
(billion cubic meters)
Share of world total (%)
Iran 239.5 6.32%
Iraq 13 0.34%
Kuwait 17.5 0.46%
Saudi Arabia 112.1 2.96%
Bahrain 14.8 .39%
Qatar 175.5 4.63%
UAE 64.7 1.71%
Oman 36 0.95%
Total 3791.5 17.8%

The subsequent figure provides a graphical representation of the oil and gas platforms and
terminals located in the Gulf. The Strait of Hormuz is one of the most important and critical global
passages. This waterway is the only opening of the Gulf to the wider ocean, and at its narrowest
point is only 21 miles wide, generating a critical oil chokepoint (Energy Information
Administration, 2019).
7

This strait supports both inbound and outbound traffic lanes, each 2 miles wide, with a 2-
mile wide safety separation zone between them. The inbound traffic lane is closer to Iran while
the outbound traffic lane is closer to Oman. It is estimated that 21 million barrels per day, or
roughly 30% of all seaborne oil exports, passes through the strait as of January 2020. Daily tanker
traffic rates average 40 tankers per day, or about 15,000 tankers per year (S&P Global, 2020).
A disruption in the ability to transport oil through the strait can have global consequences,
with roughly a quarter of worldwide petroleum products consumption being carried daily through
the strait. Saudi Arabia and UAE have pipelines that can bypass the Strait of Hormuz and carry
crude oil outside the Gulf with a total capacity of 6.8 million barrels per day, nearly one-third of
the total daily figure (Energy Information Administration, 2020).
Figure 2.2 Map of the Gulf and Petroleum Infrastructure (Nadimi, 2020)
8

China, Japan, India and South Korea are the biggest consumers of the crude oil and
condensate that pass through the Strait of Hormuz, amounting to roughly 60% of exports from the
Gulf region (Energy Information Administration, 2020).
The heavy maritime traffic and oil production produce an ongoing issue of pollution in the
Gulf that is difficult to control. Illegal dumping of oil from tankers passing through the Gulf has
been a challenge for the region to track and quantify (Meshkati, Tabibzadeh, Farshid, Rahimi, &
Alhanaee, 2016). A major environmental and health concern with offshore oil platforms are the
drilling muds, produced water, deck runoff water, spills and leaks that are discharged into the
water. Drilling muds contain toxic chemicals that are harmful to the environment, ecosystems,
human health and wildlife as well as pose a risk to water quality. An average offshore platform is
estimated to discharge over 90,000 tons of drilling fluids (Oceana, 2018).
0
5
10
15
20
25
2014 2015 2016 2017 2018
petroleum products
crude oil and condensate
Crude oil, condensate, and petroleum products transported through the Strait of Hormuz
million barrels per day
Strait of Hormuz
Saudi
Arabia
U.A.E
Iraq Iran
Kuwait
Bahrain
Qatar
Strait of Hormuz maritime chokepoint
East-West crude oil pipeline
Abqaiq-Yanbu NGL pipeline
Abu Dhabi
crude oil pipeline
Oman
Figure 2.3 Strait of Hormuz Oil Chokepoint (Energy Information Administration, 2019)
9

The surrounding Gulf countries have been working towards diversifying their economies
over the last several years to reduce their high dependency on oil. Figure 2.4 shows the change in
non-oil GDP for some of these countries between 2000 to 2018 (UAE and Kuwait comparisons
are between 2010 and 2018 due to lack of data prior to 2010). By 2019, UAE and Bahrain had the
most diverse economies, while Oman,
Saudi Arabia, Qatar and Kuwait still
displayed a heavy dependency on oil,
with nearly 50% of their respective
GDPs stemming from oil-related
activities (Ollero, Hussain, Varma,
Peszko, & Al-Naber, 2019).
In the pursuit of expanding the diversity of the respective economies represented in the
region, there has been a region-wide crescendo of nuclear energy infrastructure development,
which will have overarching consequences for inter- and intra-region communication, geo-
political conflicts, vulnerability to catastrophic system failures, and water dependency.

Figure 2.4 Non-Oil GDP (%) Comparisons in the Gulf
(Ollero et. al, 2019)
10

Chapter 3

Nuclear Power in the Gulf

1975. Construction began on two
Pressurized Water Reactor (PWR) units in
Bushehr, Iran. From 1984-1988, Iraqi jets
attacked the facility, damaging it during the
Iran-Iraq War that took place between 1980-
1988. In 1995, Iran signed an agreement with
Russia to complete Unit 1 of Bushehr. After
many hurdles and delays, the VVER-1000
reactor was connected to the grid and began
commercial operation in 2013 (World Nuclear
Association, 2020a).
In 2014, the Atomic Energy Organization of Iran (AEOI) signed an agreement with Russia
for construction of four more reactors at Bushehr and another four reactors elsewhere. First
concrete for Unit 2 in Bushehr was poured in November 2019, with a target for commercial
operation in 2024. Unit 3 has a commercial operation target date of 2026, while Units 4 & 5 target
dates have not been determined yet. In 2015, AEOI announced an agreement with China to build
two 100MW units in Makran by the Gulf of Oman, which will be explored further here due to its
close proximity to the Strait of Hormuz (World Nuclear Association, 2020a). In summary, Iran is
projected to go from having one operating nuclear power reactor on the Gulf side in 2020 to as
many as seven+ reactors in the succeeding 10-15 years.
Figure 3.1 Nuclear Power Plants in Iran
(World Nuclear Association, 2020a)
11

Nuclear power plants in the Gulf have been a trending topic for the last several years, with
the members of the Gulf Cooperation Council (GCC) in 2007 (UAE, Saudi Arabia, Kuwait, Qatar,
Oman and Bahrain) announcing a cooperation with the IAEA to conduct a feasibility study of
nuclear power in the region (World Nuclear Association, 2020b).
That same year, the UAE Government conducted a study to evaluate the country’s electricity
generation supply and forecast the country’s electricity demands. Results concluded that the annual
peak demand for electricity was expected to rise over 40GW by 2020, at an annual growth rate of
9%, roughly 3 times the global average (“Policy of the UAE”, 2008). The study showed that the
country’s current generation capacity will not be able to meet the future growing demand (Figure
3.2).

Figure 3.2. UAE Generation Capacity and Projected Demand (“Policy of the UAE”, 2008)
12

Therefore, the UAE government evaluated different options to meet the projected future energy
demands. They concluded that the most efficient and reliable way to meet these demands would
be through nuclear power generation, due to the following factors:

• Diversify the nation’s energy supply
• Drive the growth of a major high-tech industry in UAE
• Provide thousands of jobs
• Commercially competitive power generation
The UAE Government established a target of 40,000 MW, or 25% of future electricity demand,
sourced from nuclear power generation by 2020.

In 2009, Emirates Nuclear Energy Company (ENEC) and Federal Authority of Nuclear
Regulation (FANR) were formed. The primary role of ENEC is to lead the development and
building of the nuclear power plants, while FANR serves as the regulatory body of the nuclear
sector overseeing safety, security, licensing, inspection as well as the contracts and agreements
and setting the standards for the nuclear sector in UAE.

That same year in 2009, the UAE started a bidding process, in which nine companies took
part in, to decide who would construct the UAE’s first nuclear power plants. The UAE selected a
consortium led by Korea Electric Power Corporation (KEPCO) as the winning bidder to design,
build and operate four Generation III+ APR-1400 reactors, totaling $20.4 billion (Schneider,
2019). Site selection studies were undertaken, and the UAE determined Barakah to be the location
for their first nuclear power plant (Fig. 3.3), located in the Western region of Abu Dhabi
(Beveridge, 2009).
13

Figure 3.3. Location of Selected Nuclear Reactor Site – Barakah (World Nuclear Association, 2018)

All 4 of the reactors in the UAE, named ‘Barakah’, have commenced construction and are
located with access to the Gulf for cooling, with the first reactor expected to go live in 2020.
In 2009, Saudi Arabia formed the King Abdullah City for Atomic and Renewable Energy (KA-
CARE) to work towards the development of nuclear power in the region, and in 2011 announced
ambitious plans to build 16 nuclear reactors by 2032 with a 17GWe capacity. However, in 2015,
they decided to scale back their plan to two large reactors totaling 2.8GW capacity with the
possibility of adding up to 16 reactors by 2040 (World Nuclear Association, 2019). Two potential
site locations have been shortlisted – Umm Huwayd and Khor Duweihin – following international
regulatory guidance by the International Atomic Energy Agency (IAEA) and the US Nuclear
Regulatory Commission, (NRC) according to MEED (2019). Both these locations sit on the Gulf.

14

Kuwait’s attempts to pursue nuclear power stem back to the 1970s. In coordination with
the IAEA and United Kingdom Atomic Energy Authority, Kuwait established a nuclear energy
committee and issued a request for proposal (RFP) in the 1970s. However, after the Three Mile
Island nuclear accident in 1979, Kuwait decided to cancel the development of a nuclear program.
Decades later, in 2009, since domestic energy demands continued to grow, Kuwait explored the
development of a nuclear program once again, forming the Kuwait National Nuclear Energy
Committee (KNNEC) and signing a cooperation agreement with Russia’s state atomic energy
corporation, Rosatom, in 2010. Shortly after, in 2011, the Fukushima Daiichi nuclear accident
occurred, and Kuwait found itself canceling its plans once more (AlNasrallah, 2018). However, in
2018, the Russian energy minister disclosed that negotiations were underway between Rosatom
and Kuwait to build the first nuclear reactor in Kuwait (Asaba, 2018).

In the next decade or two, projections bring the Gulf region from having only one nuclear
reactor to anywhere between 14 to 28 nuclear reactors by the year 2040, as depicted graphically
in Figure 3.4. This fast expansion produces an additional layer of complexity and increasing need
for collective collaboration and communication across surrounding countries to preserve the safety
and sustainability of energy and the shared Gulf water.

Nuclear reactors require extensive amounts of highly treated water for cooling. This means
pumping water from the Gulf, and after specialized treatment, into the reactors to cool, and
subsequently discharging warmer water into the Gulf as these reactors use once-through cooling
methods. The warmer the water gets, the less efficient it is in cooling, resulting in larger amounts
of water needed to cool, and in turn larger amounts of warmer water dumped back out into the
Gulf. It develops a vicious cycle of temperature increase. The Gulf is already expecting to see an
15

increase in water temperature due to climate change, and this will only exacerbate the effect.

Figure 3.4 Nuclear Reactor Projections in the Gulf
16

Moreover, the Gulf water is the primary source of drinking water for most of the
surrounding Gulf countries, processed through desalination. The success of the nuclear industry is
directly linked to the success of the desalination industry. As the nuclear industry inevitably grows,
it will further intensify the vulnerabilities in the desalination industry and increase the fragility of
the Gulf as a water source.

17

Chapter 4

Desalination in the Gulf

The Gulf region is one of the driest and most water-stressed regions in the world, with
Qatar, Kuwait, Saudi Arabia, UAE, Bahrain and Oman all ranking as six of the seventeen countries
classified under Extremely High Baseline Water Stress by the World Resources Institute (Hofste,
2019). This classification - the most severe of the six categories available - represents countries
that withdraw on average over 80% of their available supply in a given year. It signifies a high
vulnerability to sudden changes in supply and demand, or more concerningly, a large-scale oil or
nuclear disaster in the region, threatening water supplies.
The Gulf water plays a crucial role in securing reliable water supplies for the surrounding
countries. In fact, even though the Gulf’s water surface area represents less than 0.1% of the
world’s water surface area, a striking 70% of the world’s desalination capacity is located in this
body of water (USGS, 2020).
The Gulf Research Center released a report displaying percentages of potable water
obtained through desalination in 2010 for some of the cities in the Gulf, and include the following
(Bachellerie, 2012):
Table 4.1. Desalinated Drinking Water Percentages in the Gulf
Country % of Potable Water that is Desalinated
Abu Dhabi, United Arab Emirates 95%
Dubai, United Arab Emirates 95%
Kuwait 95%
Bahrain >80%
Qatar 99%
Oman 80%
18

These figures are alarmingly high and signify the importance and extreme dependency of
these countries on the Gulf water. This region is one of the driest in the world with minimal rainfall
of about 20 cm a year (Rajavi, 2013). Availability of water from alternative sources such as
groundwater is minimal, and therefore this dependency is projected to keep growing.

Saudi Arabia and Iran have lower percentages of their potable water obtained through
desalination, with 50% of water in Saudi Arabia estimated to be sourced from desalination, and
less than 1% in Iran (Al-Ghalayini, 2018; Aquastat, 2008). Saudi Arabia is the largest producer of
desalinated water in the world, with 22% of the world’s desalinated water produced by Saudi
Arabia alone (SWCC, 2020).

Figure 4.1. Desalination Capacities of Countries Around the World (“Desalination in GCC”, 2015)
19

Figure 4.1 depicts desalination capacity by country in 2009, evidently displaying the high
cluster in the Gulf, and it has only been increasing since then.

There are three main techniques used for desalination (“What are the different”, 2019):
• Thermal processes: includes multi-stage flash (MSF) distillation, multi-effect distillation
(MED) and mechanical vapor compression (VC). Water is boiled and the steam is collected
and condensed, leaving saltier water behind.
• Electrical processes: uses electric current to drive ions through membranes separating the
salt and water.
• Pressure processes: reverse osmosis (RO) applies pressure to drive salt water through a fine
membrane, where freshwater passes through and saltier water is left behind.

In the Gulf, most of the large desalination plants used are thermal desalination plants, with
the trend shifting towards reverse osmosis for the newer plants as a result of technological
improvements leading to more desirable cost, efficiency and sustainability. The following table
summarizes the numbers and types of the main plants (exceeding ~10,000m
3
/day) located in the
Gulf, details of which can be found in the Appendix:

Table 4.2. Desalination Plants in the Gulf
Process KSA UAE Bahrain Kuwait Qatar Oman Iran Total
MSF 5 13 1 5 6 - - 30
MED 1 1 1 1 1 - - 5
RO 3 14 2 1 2 4 6 32
VC - - - - - - - -
Mixed 1 9 1 1 - - 1 13
Total 10 37 5 8 9 4 34 80
(Note: This does not include plants under construction, plants with less than ~10,000m3/day, or plants where data was not publicly available)

20

In the past 30 years, the capacity of the desalination plants in the Gulf has been increasing
drastically, from 5 million cubic meters per day in 1985 to 24 million cubic meters per day in 2015
(Saif, 2012). It has been projected that water demand in the Gulf will increase by 50% by 2050
according to Saif (2012) intensifying the dependency on this body of water.
With this, comes the issue of salinity. It is estimated that for every 1m
3
of desalinated water
produced, roughly 2m
3
of brine - highly concentrated salt water - results (The Economist
Intelligence Unit, 2018). This brine is then discharged back into the Gulf. As desalination
operations increase, brine discharges increase. This creates a cycle of gradually increasing salinity
levels in the Gulf, not only impacting the environment and ecosystems, but also intensifying the
energy requirements to desalinate water as salinity increases, making desalination plants less and
less economically viable.
Another concern in this water-stressed region is the vulnerability of these systems to a
hiccup in demand and supply. In the case of an emergency where the Gulf becomes contaminated,
supplying water to the residents will be a major concern. Until 2018, UAE only had enough water
in storage to supply residents for three days, should an emergency occur (“Desalination in GCC”,
2015). The emirate of Abu Dhabi, the capital of the UAE, has worked to improve that. In 2008, an
agreement was signed with German Company GIZ to build an underground water reservoir in Abu
Dhabi to hold a 90-day supply of water for the residents of Abu Dhabi, or 5.6 billion gallons. In
other words, 1 million residents will be able to receive 180 liters of water per day for 90 days. The
project was completed in 2018 through a network of 315 recovery wells and fed by pipeline
networks from one of UAE’s desalination plants – Shuweihat (“World’s largest”, 2018). The
emirate is planning several more underground reservoirs to supply water to the other emirates.

21

Saudi Arabia is also building water storage facilities for emergencies. The largest project
is currently being undertaken in the city of Jeddah in the form of a 4.6 million-cubic-meter storage
facility that will then be expanded to add a 6 million-cubic-meter facility to serve the 5 million
residents living in that city. It is important to note that this is a project serving the Red Sea side of
Saudi Arabia, not the Gulf side. Plans for the other cities are also underway (Almashahi, 2015).

In 2015, Qatar announced the initiation of a Mega Reservoirs Project, where 24 reservoirs
of 2300 million gallons in total capacity will be built in five locations around the country. This is
the first stage of the project with a target goal of 2026 and will supply the residents with a 90-day
supply of water in the case of an emergency. The second stage of the project is the construction of
40 more reservoirs of 3800 million gallons in total capacity with a target date of 2036. Currently,
Qatar can only supply enough water to last 48 hours (Kahramaa, 2015).

Research studies modeling residence times in the Gulf – the average flushing time of a
particle in the Gulf to exit through the Strait of Hormuz - suggest it can take anywhere from 2 to
4 years for a particle to exit (Alosairi, 2017). As this region rapidly grows its nuclear power sector,
with planned reactors located around the Gulf, the water stress and extreme dependency on this
body of water for potable water supplies becomes an even more critical issue for the safety and
security of the surrounding countries’ 168 million residents.

22

Chapter 5
Climate Change in the Gulf

The Gulf region is experiencing some of the hottest temperatures in the world, and these
temperatures are expected to continue to climb. In June 2019, Kuwait recorded temperatures of
54C (129F), the highest temperatures ever recorded in the Eastern Hemisphere, and likely the
world (Shurafa, 2019).
Jeremy Pal’s (2016) publication in Nature Climate Change presented temperature forecasts
in the Gulf as a result of greenhouse gas projections over the next century. They looked at RCP8.5
(business as usual) and RCP4.5 (mitigation) scenarios, and found that at RCP8.5, some of the cities
in the Gulf will reach wet bulb temperatures (TWmax) of 35C, within the next century. This is a
critical point as wet bulb temperature (combination of temperature and humidity) of 35C is the
threshold for fit human survivability. Figure 5.1a depicts historical data from 1976-2005, 5.1b is
future projections in 2071-2100 with mitigation (RCP4.5), and 5.1c is future projections in 2071-
2100 continuing business as usual (RCP8.5).
Figure 5.1. Temperature Projections in Southeast Asia (Pal, 2016)
23

Even though the countries around the Gulf are starting to introduce nuclear power, which
does not contribute to the greenhouse gas concern, it is important to note that these nuclear power
plants need vast amounts of water for cooling in the magnitude of hundreds of thousands of gallons
per day. They will be extracting colder water from the Gulf and discharging much warmer water,
which could play a significant role in the warming of the Gulf, despite not contributing to
greenhouse gases.
Pal’s paper focuses solely on greenhouse gas warming and therefore does not take into
consideration potential warming caused directly from these nuclear power plants that are being
introduced within the next century. These nuclear power plants could exacerbate the warming
effect much quicker than projected.
Moreover, it is important to note that this change in temperature will also impact
efficiencies of nuclear reactors. The warmer the water gets, the less efficient its cooling capabilities
are. Larger volumes of water will be required to cool, and subsequently larger volumes of warmer
water will be discharged back into the Gulf, developing a vicious cycle of temperature change.

Nuclear reactors are very susceptible to increasing temperatures as the safety of their
operations depends heavily on the availability of cooling water. Reactors around the world have
had to shut down or curtail production in instances of extreme heat, especially heat waves. In 2003,
2006, 2015, 2018 and 2019 reactors all across Europe in France, Sweden, Spain, Germany and
Switzerland, to name a few, have had to shut down or curtail production as a result of heat waves
(Qvist, 2019). These shutdowns as a result of high temperatures have been steadily increasing.

24

With the Gulf countries experiencing some of the hottest temperatures in the world, the
availability of cooling water, reactor efficiencies and warming of the Gulf is a rising concern. In
2014, renewable energy in the region became cost-competitive, and subsequently, UAE decided
to aim for 30% of total energy to constitute clean energy by 2030 (IRENA, 2015; McAuley, 2016).
This goal is primarily a mix of nuclear and solar power, with the country launching several large-
scale solar power projects over the last several years. In April 2019, a 1.2GW solar power plant
commenced operations, becoming the world’s largest single-project solar PV plant, and in 2020 a
contract was awarded for an even larger 2GW solar power plant in Abu Dhabi (Dudley, 2020).
Other countries have also been growing their solar power sectors, with Saudi Arabia launching
plans for a 1.2GW solar power plant, Bahrain launching a 5MW hybrid wind and solar project and
Qatar launching an 800MW development, to name a few (OBG, 2020; Parnell, 2020; Bellini,
2020). Nuclear energy is considered to be the most reliable source of energy for these countries,
due to its high capacity factor in comparison to alternative sources of energy. In 2019, the U.S.
Energy Information Administration estimated that Nuclear Power had an average capacity factor
of 93.5%, while solar power had an average capacity factor of only 24.5% (Mueller, 2020). Nuclear
power plants are able to run at their maximum power much more consistently due to their ability
to operate for long periods of time without refueling and the need for less frequent maintenance,
as opposed to solar power which is much more discontinuous due to its dependence on access to
sun.

While the scope of this research project will not further examine the effects of climate
change and the warming of the Gulf, it is highlighted in this chapter because of its significance
and implications with the increasing introduction of nuclear power in the Gulf.
25

Chapter 6

Multi-Industry Dependencies
(Expansion of Modarres and Schroer’s work)

The three industries (nuclear-oil-desalination) work independently of each other in the
Gulf, despite the intertwined complex interdependencies that exist between them as a result of
sharing a critical body of water and the increasing density and scale of their operations. We are
interested in classifying and evaluating these interdependencies to be able to understand the
various risks associated between these industries and effectively mitigate the occurrence of a large-
scale disaster.

With regards to the nuclear industry, many nuclear power plants have more than one
reactor, while traditional Probabilistic Risk Assessment (PRA) accounts for the risk of each unit
individually and does not consider the relationship between these multiple units or the risks
associated that can impact more than one reactor simultaneously. The multi-unit Fukushima
Daiichi accident of 2011 is a clear example of why it is important to understand the risks associated
with multiple units at a nuclear power plant. Three of the six units at Fukushima Daiichi were in
operation when a major earthquake followed by a tsunami hit the region disabling the power and
cooling functions of all three units (Units 1, 2 and 3), resulting in severe core damage. A hydrogen
explosion in Unit 1 damaged the reactor building of Unit 1 as well as Units 3 and 4 (“Committee
on lessons learned”, 2014).

Dr. Mohammad Modarres and Susan Schroer’s work on multi-unit dependencies in the
nuclear industry is the only credible and robust study found focusing on addressing these
26

connections and relationships between multiple units within a nuclear power plant (Schroer, 2013).
Their work extends the traditional Probabilistic Safety Assessment (PRA) used on single units in
a nuclear power plant to a more integrated approach of Multi-Unit (MUPRA) to account for the
effects of accident sequences from one unit propagating and impacting other units located at the
same plant, as was the result in Fukushima Daiichi.

We look to extend this work further to now account for multi-industry dependencies,
specifically the oil, nuclear and desalination industries. The premise of this work is to evaluate and
quantify these dependencies with an application to the Gulf where offshore oil platforms,
desalination plants, and soon, a plethora of nuclear power plants will be collectively depending on
the Gulf water for their operations.

Figure 6.1. Multi-Industry Impact – Venn Diagram
27

Extending the multi-unit case, we can construct a similar Venn Diagram to represent the
multi-industry scenario as presented in Figure 6.1, where N represents an event in the Nuclear
Industry, O – an event in the Oil industry, and D – an event in the Desalination industry, and 𝑁
"
,
𝑂
$
, 𝐷
"
represent the absence of these events. Since this diagram represents different industries, the
definition of intersections is more complex. The focus of this research is the occurrence of
interdependent events across industries, therefore only the intersections of the above Venn diagram
will be studied, and all independent events at individual industries will be disregarded.

Failure will therefore be classified as follows:

(1) An internal event in one industry triggering the curtailing or halting of production in a unit
of another industry will constitute an interdependent failure for both industries, e.g. a tanker
leaking oil in the Gulf resulting in curtailing of production at a desalination plant nearby
will be considered as an interdependent failure of the oil and desalination industries,
represented by 𝑁
"
∩𝑂∩𝐷.

(2) An external event triggering the curtailing or halting of production in a unit of more than
one industry will constitute an interdependent failure for all industries affected, e.g. strong
winds impacting operation of a unit at a nuclear power plant, as well as an oil platform will
constitute an interdependent failure of both the nuclear and oil industries, represented as
𝑁∩𝑂∩𝐷
"
.

28

The probability of the union of these three events is derived to be as follows:

𝑃(𝑂𝐹∪𝑁𝐹∪𝐷𝐹)=𝑃(𝑂𝐹)+𝑃(𝑁𝐹)+𝑃(𝐷𝐹)− 𝑃(𝑂𝐹∩𝑁𝐹)
− 𝑃(𝑂𝐹∩𝐷𝐹)−𝑃(𝑁𝐹∩𝐷𝐹)+𝑃(𝑂𝐹∩𝑁𝐹∩𝐷𝐹) (6.1)

where OF is Oil Failure, NF is Nuclear Failure, and DF is Desalination Failure.

6.1 Cause and Effect Diagram Analysis (“Fishbone Diagram”)
There are various events that could generate risk dependencies between multiple industries.
To be able to effectively characterize these potential risks and interdependencies across industries,
eight main categories have been established using and building upon Schroer’s (2013) six
categories for nuclear power plants: natural disaster, government and regulation, identical
components, human influences, organizational influences, physical proximity, economic events,
and shared connections. These categories are depicted in the following fish-bone diagram:

Figure 6.2. Cause-and-Effect Diagram for Multi-Industry (Desal-Oil-Nuclear)

29

6.1.1 Natural Disasters
The first component accounts for the potential natural disasters that could occur and span
multiple industries. This could include earthquakes, tsunamis, sandstorms and other events.

6.1.2 Government and Regulation
These industries can contain overlap when it comes to government and legislator bodies.
For example, in the case of UAE, the government is the overlaying entity over the Barakah nuclear
power plants, Abu Dhabi National Oil Company, and Abu Dhabi Water and Electricity Agency in
charge of water production from desalination. Some examples of how this can impact all three
industries are as follows:

• Reduction in government funding leading to shortcuts and workarounds
• Policies on discharge to the Gulf applicable to all industries
• Decision making on formation of boards of directors for the three industries
• Lack of adequate training and response strategies for emergencies

If governments face budget cuts that impact these industries, this could lead these industries
to make decisions of cutting staff, reducing maintenance, and finding shortcuts to save money,
which could potentially impact safety. Policies made by governments and legislator bodies that
span over all industries are also inter-dependent, as poor policies could result in inadequate safety
and adverse conditions. If decisions to form these industries are conducted by the government,
decision making on selecting the board of directors, CEOs, etc could affect all industries if poor
decision-making takes place. Institutional distance within one country is also an important
consideration, as different cities in a country may have different governing boards or institutions
30

for their respective industries. In addition, formation of these industries needs to be inter-linked to
be able to collectively respond to emergencies that take place in multiple industries and allocate
resources accordingly. Passive (not pro-active) linking could result in lack of adequate response
and provision of resources to emergencies that arise.

6.1.3 Identical Components
This category refers to components that are used across more than one industry with similar
functions and operating procedures, making them susceptible to the same common-cause failures
across the different industries. This includes both physical devices and hardware as well as
software such as computer systems and programs.

6.1.4 Human Influence
Human influences are related to decisions or actions that a person undertakes that affects
multiple industries. This could be an internal influence from within the company (e.g. an operator
or a supervisor), or it could be an external influence from an external person (e.g. a vendor or a
visitor).

The two are split into separate categories because managing the two can be drastically
different. Internal influences can potentially be easier to manage, track and assess through training
programs for employees, internal checklists, company guidelines, in-house reviews and feedback.
External influences have the additional layer of being disassociated from the company with a
potentially lesser degree of obligation or commitment to meet the company’s guidelines or
expectations.

31

For example, in a hospital setting, nurses and doctors (internal) may be very aware of not
unplugging vital machinery in a patient’s room, whereas a custodial staff who has been contracted
from an outside vendor (external) may be less aware and concerned with the hospital environment
and could potentially unplug vital machinery from a wall socket unknowingly, to plug in a cleaning
device. The custodial staff is more concerned with their own commitment to their company and
getting their task or job done, than any commitment to the hospital and the hospital’s guidelines.

Therefore, when it comes to external influences from outside persons it is important for the
respective industry to have proper safeguards in place to remove or drastically reduce the potential
for a mishap to occur, whether unintentional or intentional (e.g. intentional hacking of computer
systems).

This can also be broken down further as presented in Figure 6.3 to account for the different
types of human influences that exist: latent and active.

Figure 6.3 Human Influence Categories for Multi-Industries
32

Latent influences are actions or influences that are not felt immediately but may be
discovered after a period of time or may only be discovered after a triggering event occurs. An
example of this could be incorrect installation of an emergency device that is not discovered until
an emergency occurs and the emergency device fails to operate as expected under the emergency
condition. An active influence is one that is felt immediately due to the immediate impact that it
has (Reason, 2000). The following is a list of examples in each sub-category of potential incidents
affecting multiple industries:

• Internal and Latent: Inadequate resources affecting multiple organizations’ internal
operations (e.g. lack of manpower, lack of training resources)
• Internal and Active: An incorrect action or procedure resulting in a widespread fire or
explosion impacting other industries in close proximity
• External and Latent: A vendor employee serving multiple industries mirroring an
incorrect procedure/installation.
• External and Active: A maintenance crew member making an incorrect adjustment to a
shared connection between multiple industries e.g. resulting in sudden loss of power.

Human influences can be the result of various factors including lack of expertise, fatigue,
complacency, physical ailment, unclear guidance, and pressure to get task done, to name a few.
These can be the result of an individual’s conditions such as physical ailment, or it could be the
result of organizational issues, such as unclear work instructions and poor workplace design.

33

6.1.5 Organizational Influence

An organizational influence refers to a type of culture that is present within an organization
i.e. a group of people. This could be a specific department in an organization, the management
team, or even an outside vendor that is used (Zidane, 2015).

Organizational influences will be divided into two categories: Internal and External.
Internal organizational influences refer to an organizational culture within one organization that is
mirrored or similar in another organization. This could be as a result of two main sub-classes:
Shared Factors and Individual Factors.

Shared Factors refer to pre-existing conditions or outside environments that more than one
organization shares that results in a certain culture permeating within multiple organizations. This
could be due to government, regulations, economic conditions, or political conditions, to name a
few. An example of this could be the existence of many diverse groups and nationalities in the
Gulf resulting in a multi-national and multi-cultural workforce in multiple industries that could
introduce similar language barriers and cultural influences across multiple industries.

Individual Factors refer to factors that stem from within one organization creating a certain
culture in that organization, while a second organization develops a similar culture stemming from
its own individual factors. An example of this is the senior management team at a nuclear power
plant stressing the importance of speed and efficiency, permeating a culture within the organization
that is not focused on prioritizing safety, leading to corners being cut, and similarly the
34

management team at an oil facility nearby creating a similar culture leading to skipped
maintenance tests and neglecting certain guidelines in a parallel manner.

An External organizational influence refers to an external party (e.g. a vendor that is used
in multiple industries) and the organizational influence that the external party has been subjected
to, that could cause incidents in more than one industry. For example, a vendor contracted to install
an important piece of equipment at a nuclear power plant as well as an offshore oil platform, and
the employees of this specific vendor are consistently overworked and fatigued, leading to
incorrect or incomplete installations in more than one industry.

Figure 6.4 Organizational Influence Categories for Multi-Industries

35

6.1.6 Physical Proximity

A physical proximity dependency is when multiple industries share the same environment
and locality that could be impacted by an event that affects multiple industries. For example, a
nuclear power plant explosion and radioactive cloud and fallout seeping into the Gulf atmosphere
could impact surrounding offshore oil platforms and desalination plants. Further examples are
presented in the following list:

• Nuclear reactor fallout or oil leak impacting another industry close by
• Explosion in one industry affecting a second closely located industry
e.g. flying debris
• A tanker accident and leak impacting both the oil industry and desalination industry
operations

6.1.7 Economic Events

An economic event is one that affects the economy of a country, resulting in decision-
making that impacts all industries. This could include events like a recession, job losses, inflation
etc. Some examples of these events and how they can impact multiple industries are presented in
the following table:
• A recession could lead to job losses and manpower impacting safety across all industries
• Inflation could lead to cutting corners to save money, causing a poor safety culture
• Employees could be more stressed out, overworked, leading to poorer decisions

36

6.1.8 Shared Connection

A shared connection is defined as some sort of link or component that is shared between
multiple industries. When this connection/link fails, the impact is witnessed across multiple
industries. The following list illustrates examples of potential shared connections:
• Shared power lines – loss of power affecting multiple connected industries
• Shared cyber security – a cyber attack can impact all industries
• Shared ports/road access – blockages impacting more than one industry
• Shared emergency response team e.g. same nearby fire department – if multiple industries
need help responding to an emergency, allocation of resources may be difficult.

37

Chapter 7

Classification Schema for Analysis
of Multi-Industry Events

In order to evaluate risk and vulnerabilities across the three industries (nuclear-oil-
desalination) and capture the potential dependencies that may occur through the above-proposed
categories, the first stage consists of collecting historic data of incidents in these industries. This
is a little more complex than the analysis presented in (Schroer, 2013) as these industries work as
independent industries and classifications of events and reporting are undertaken by different
agencies for different countries. In addition, there are limitations and restrictions that will need to
be accounted for and will be addressed further in this below-section.

7.1 Limitations of Study

Due to the independent nature of the three industries in incident reporting, and the lack of
data corresponding to a similarly concentrated area of desalination, oil and nuclear reactors
elsewhere in the world, several assumptions are made.

1) Nuclear Reactor Incidents: There is only one current operational nuclear reactor in the
Gulf located in Bushehr, Iran and access to incident reports is not publicly accessible.
Therefore, historic data for the nuclear industry in this region is very limited. To account
for this limitation and gain a more comprehensive blueprint of past reactor incidents, data
from the US Nuclear Regulatory Commission (NRC) will be used.
38

• Licensee Event Reports: These are readily accessible written reports that cover a
broad spectrum of events occurring at nuclear reactors in the US. This data will be
limited to pressurized water reactors as this is the technology being used in Bushehr
as well as emerging reactors in UAE and Saudi Arabia.

• Inspection Reports: Utilities submit performance indicators to the NRC on a
quarterly basis, based on certain measures and thresholds. The NRC has an
inspection program to monitor and assess performance and verify performance
indicators. Together, these inspections and performance indicators are used to
assess licensee performance and determine the appropriate response which includes
supplemental inspections if a plants performance is sub-par (U.S. NRC, 2020a).
Plants that require the following supplemental inspections have been considered to
require more serious assessment and will be evaluated in more detail, to assess their
organizational culture, as individual LERs may not provide the complete picture
of a plant’s overall performance and organizational culture, which is an important
consideration in the potential of a multi-industry event:

o IP 95001: Supplemental Inspection for One or Two White Inputs in a
Strategic Performance Area
o IP 95002: Supplemental Inspection for One Degraded Cornerstone or Any
Three White Inputs in a Strategic Performance Area
o IP 95003: Supplemental Inspection for Repetitive Degraded Cornerstones,
Multiple Degraded Cornerstones, Multiple Yellow Inputs or One Red Input
39

2) Offshore Oil and Gas Platform Incidents: While a plethora of oil and gas platforms
exists in the Gulf and have been in operation for decades, due to the political environment
and nature of the littoral countries’ strategic and security related practices, public access to
detailed incident reporting is not available. The Bureau of Safety and Environmental
Enforcement (BSEE) in the US focuses on the offshore oil and gas industry on the U.S.
Outer Continental Shelf, and publicly releases incident statistics on injuries, spills,
collisions and more, with details behind the occurrences of these incidents, and therefore
will be used as the basis for this section.

Figure 7.1 Event Report Breakdown for Data Analysis

40

The limitation due to lack of accessibility to relevant data in the region does not limit the
applicability of this analysis, as lessons can still be learnt from these industries in different regions.
Systems, technologies, and humans are susceptible to failure, irrespective of location or region.

One significant example of this is the case of BP Deepwater Horizon incident. On the 21
st

of August 2009, several months before the BP Deepwater Horizon oil spill, an incident occurred
in Australia, known as the Montara oil spill. A well blew out and oil spilled into the Timor Sea for
74 days before finally stopped. The compounding issues were found to be lack of expertise and
negligent maintenance which resulted in a failed cemented casing shoe. Several months later in
April 2010, the BP Deepwater Horizon spill occurred spilling oil into the Gulf of Mexico for 5
months before being stopped. When the cause was identified, similar findings to the Montara
incident were cited. Had lessons been learnt from the Montara oil spill, this incident could have
very well been preventable (Tinmannsvik, 2011).

While the reliance on data from U.S oil and nuclear operations is still considered relevant
and applicable, it is important to acknowledge and consider that some differences do exist, e.g.
higher sea-water temperatures and the occurrence of sandstorms in the Gulf.

Furthermore, because these two industries (nuclear and oil) contain the risk of a sudden
large-scale event requiring immediate attention and the third industry (desalination) does not pose
the same scale of immediate risk but rather a more creeping threat (e.g. salinity increase), only
incidents at the nuclear and oil industries will be used for this analysis as it requires much more
urgent attention and response.
41

7.2 Categorizing Data and Identifying Risk

Following the identification of the eight categories that constitute potential
interdependencies in Chapter 6, the objective is to analyze the historic data that is available and
consolidate into one or more of these categories.

• Natural Disasters
• Government and Regulation
• Identical Components
• Human Factors
• Organizational Factors
• Physical Proximity
• Economic Event
• Shared Connections

It is important to note that an event can be a result of more than one factor, e.g. an
earthquake followed by an operator not following protocol would be classified as both a Natural
Disaster and a Human Influence related incident.

Because the data used is from outside the Persian/Arabian Gulf region, some assumptions
will need to be made for categories: physical proximity and shared connections, as these are
directly linked to locality of event. A simple Yes/No logic will be used for the general classification
of these two categories to determine whether these categories may potentially generate an
interdependency across two or more industries, as presented in Figures 7.2 and 7.3.
42

Figure 7.2 Yes/No logic for the potential of physical proximity creating a multi-industry event

Figure 7.3 Yes/No logic for the potential of a shared connection creating a multi-industry event

We are interested in identifying risk (probability of a certain event occurring), as well as
consequence (the severity and impact of an event). To determine whether an event has the potential
of leading to a multi-industry failure, had this event occurred in the Persian/Arabian Gulf under
43

certain conditions, the consequences of events will be analyzed, and a severity measure assigned.
Severity characterization for the oil industry and nuclear industry will differ due to the differences
in the nature of the incidents, their methods of reporting and the data available.

7.3 Severity Characterization for Oil and Nuclear Industry Events

In order to identify the severity of each incident in the nuclear and oil industry, the
following 4 consequences will be evaluated as key consequences, following Hokstad’s (2012)
categories, to evaluate when an undesired event occurs:

• Life & Health: this focuses on human injuries, illnesses and fatalities resulting from an
undesired event.
• Economic: this focuses on the financial impact on an economy (e.g. medical costs,
emergency response costs and rehabilitation/recovery costs)
• Environment: this focuses on the impact an undesired event has on the environment (e.g.
air pollution, water pollution, wildlife)
• Unavailability: this focuses on the downtime consequence of infrastructure and includes
the period of time operations have been halted or reduced, as well as recovery time, if any.

To be able to place a measure on severity of these consequences, each consequence will be
divided into 5 categories; 1 being of highest severity and 5 being of lowest severity. These
consequence categories should be determined under the guidance of the relevant stakeholders
involved in the study in conjunction with the aim of the study. For the sake of this analysis, these
44

categories have been assigned by analyzing past critical infrastructure large-scale events and
environmental impact assessments as a foundation to quantify severity of incidents in oil and
nuclear operations in the United States (BTS, 2019; NOAA, 2020; Ramseur, 2017; U.S. NRC,
2018a).

Figure 7.3 Life & Health Consequence Categories for the Oil Industry

With regards to economic consequences, these categories can be broken down further to account
for the different areas of consideration and to allow for more rigorous analysis, and may include
areas such as:
• Cleanup costs: these costs will vary depending on size of spill, spill location, water
conditions, oil type, rate of spill etc.
• Rehabilitation costs: this includes costs for wildlife care and restoration through cleaning
efforts, relocation, and medical care.
45

• Disruption of other industries: this includes the impact a spill has on other industries
whether due to environmental impacts, (e.g. fishing industry) or other impacts (e.g.
tanker travel restrictions due to closed ports)
• Health impacts e.g. medical costs

Figure 7.4 Economic Consequence Categories for the Oil Industry

Similarly, environmental consequences can be broken down further to account for specific
measures. For example, in the Persian/Arabian Gulf, the measure of organisms and marine
mammals in the Gulf may be considered to evaluate the impact on these ecosystems, through
measures of survival, reproductive effects and development.
46

Figure 7.5 Environment Consequence Categories for the Oil Industry

Figure 7.6 Unavailability Consequence Categories for the Oil Industry

47

These developed categories can then be used as a basis to assess the severity of an incident.
For example, if we look at the BP Deepwater Horizon accident consequences, it would score a
Category 1 on all levels (Borunda, 2020):

• Life & Health: 11 fatalities
• Economy: $4 billion in clean-up costs
• Environment: Widespread pollution, irreversible damage
• Unavailability: Infinite (i.e. operations ceased)

It is important to note here that these categories can and most likely will differ based on
country, government or entity of interest. The proposed categories here are identified as a basis to
present analysis for the U.S. data of oil operations and are intended as a guideline for this analysis.
These categories will need to be adjusted based on who the person(s) of interest are in the results
of this analysis, for example, Country X might determine that a resulting expenditure of $5 million
is catastrophic at a Category 1 level, while Country Y might determine that for their economy, the
same $5 million expenditure is considered less catastrophic at a Category 4 level.

7.4 Severity Characterization Extension for NRC Licensee Event Reports
Different reporting guidelines exist between the BSEE data for offshore oil platform
incidents and NRC's LERs for nuclear reactors, and therefore further analysis will be undertaken
to account for this.
The BSEE requires incident reporting for:
48

• Crane or personnel/material handling incident e.g. striking personnel, damaging the load
etc.
• Fires and Explosions
• Injuries that require evacuation
• Medical Treatment
• Muster Incidents
• Reportable Injuries e.g. occupational injuries that result in lost time, work restrictions etc.
• Spills and Leaks
NRC's requirement of submission of LERs is much more detailed and captures events such as
(U.S. NRC, 2020b):
• Any condition prohibited by plant's Technical Specifications (except when administrative
in nature)
• The condition of the nuclear power plant, including its principal safety barriers, being
seriously degraded
• The nuclear power plant being in an unanalyzed condition that significantly degraded plant
safety
• Any natural phenomenon or other external condition that posed an actual threat to the
safety of the nuclear power plant or significantly hampered site personnel in the
performance of duties necessary for the safe operation of the nuclear power plant
• Any event or condition that could have prevented the fulfillment of the safety function of
structures or systems that are needed to safely shut down the reactor, remove residual heat,
control the release of radioactive material or mitigate the consequences of an accident
49

• Procedural errors, Equipment failures.
Because these LERs are more detailed and capture incidents that did not necessarily result
in one of the four consequence categories in Section 7.3 (life/health, economy, environment,
unavailability) that are considered serious, but still may include events with relevant and valuable
information, a further categorization will be used for LERs.
Figure 7.7 Extension of Severity Classification for NRC Licensee Event Reports

This classification was constructed after consulting several senior experts with decades of
experience in the nuclear industry and LER reporting and classifications. Criteria classified under
each level have the following definitions per the US NRC website (U.S. NRC, 2020b):

50.73a2v Prevented Safety Function:
“Any event or condition that could have prevented the fulfillment of the safety function of
structures or systems that are needed to:
Level 1:
50

(A) Shut down the reactor and maintain it in a safe shutdown condition;
(B) Remove residual heat;
(C) Control the release of radioactive material; or
(D) Mitigate the consequences of an accident.”

50.73a2vii Multiple Safety System Function:
“Any event where a single cause or condition caused at least one independent train or channel to
become inoperable in multiple systems or two independent trains or channels to become
inoperable in a single system designed to:
(A) Shut down the reactor and maintain it in a safe shutdown condition;
(B) Remove residual heat;
(C) Control the release of radioactive material; or
(D) Mitigate the consequences of an accident”

50.73a2ix Single Cause Prevention:
“(A) Any event or condition that as a result of a single cause could have prevented the fulfillment
of a safety function for two or more trains or channels in different systems that are needed to:
(1) Shut down the reactor and maintain it in a safe shutdown condition;
(2) Remove residual heat;
(3) Control the release of radioactive material; or
(4) Mitigate the consequences of an accident.
(B) Events covered in paragraph (a)(2)(ix)(A) of this section may include cases of procedural
error, equipment failure, and/or discovery of a design, analysis, fabrication, construction, and/or
51

procedural inadequacy. However, licensees are not required to report an event pursuant to
paragraph (a)(2)(ix)(A) of this section if the event results from:
(1) A shared dependency among trains or channels that is a natural or expected
consequence of the approved plant design; or
(2) Normal and expected wear or degradation.”

These have been classified as the most severe LERs as they could prevent the fulfillment of a
safety function that is required to shut down the reactor or plant safely.

50.73a2ii Plant Seriously Degraded:
“Any event or condition that resulted in:
(A) The condition of the nuclear power plant, including its principal safety barriers, being
seriously degraded; or
(B) The nuclear power plant being in an unanalyzed condition that significantly degraded plant
safety.”

50.73a2iii Natural Phenomenon:
“Any natural phenomenon or other external condition that posed an actual threat to the safety of
the nuclear power plant or significantly hampered site personnel in the performance of duties
necessary for the safe operation of the nuclear power plant.”

Level 2:
52

50.73a2x Threat to Plant Safety:
“Any event that posed an actual threat to the safety of the nuclear power plant or significantly
hampered site personnel in the performance of duties necessary for the safe operation of the
nuclear power plant including fires, toxic gas releases, or radioactive releases.”

20.2201 Theft or Loss of Licensed Material:
“(i) Immediately after its occurrence becomes known to the licensee, any lost, stolen, or missing
licensed material in an aggregate quantity equal to or greater than 1,000 times the quantity
specified in appendix C to part 20 under such circumstances that it appears to the licensee that an
exposure could result to persons in unrestricted areas; or
(ii) Within 30 days after the occurrence of any lost, stolen, or missing licensed material becomes
known to the licensee, all licensed material in a quantity greater than 10 times the quantity
specified in appendix C to part 20 that is still missing at this time.”

20.2203 Exposures, Radiation Levels and Concentrations of Radioactive Material exceeding
the Constraints or Limits:
“(1) Any incident for which notification is required by § 20.2202; or
(2) Doses in excess of any of the following:
(i) The occupational dose limits for adults in § 20.1201; or
(ii) The occupational dose limits for a minor in § 20.1207; or
(iii) The limits for an embryo/fetus of a declared pregnant woman in § 20.1208; or
Level 3:
53

(iv) The limits for an individual member of the public in § 20.1301; or
(v) Any applicable limit in the license; or
(vi) The ALARA constraints for air emissions established under § 20.1101(d); or
(3) Levels of radiation or concentrations of radioactive material in—
(i) A restricted area in excess of any applicable limit in the license; or
(ii) An unrestricted area in excess of 10 times any applicable limit set forth in this part or
in the license (whether or not involving exposure of any individual in excess of the limits
in § 20.1301); or
(4) For licensees subject to the provisions of EPA's generally applicable environmental radiation
standards in 40 CFR part 190, levels of radiation or releases of radioactive material in excess of
those standards, or of license conditions related to those standards.”

50.73a2iv Safety System Actuation:
“(A) Any event or condition that resulted in manual or automatic actuation of any of the systems
listed in paragraph (a)(2)(iv)(B) of this section, except when:
(1) The actuation resulted from and was part of a pre-planned sequence during testing or
reactor operation; or
(2) The actuation was invalid and;
(i) Occurred while the system was properly removed from service; or
(ii) Occurred after the safety function had been already completed.
(B) The systems to which the requirements of paragraph (a)(2)(iv)(A) of this section apply are:
(1) Reactor protection system (RPS) including: reactor scram or reactor trip.
Level 4:
54

(2) General containment isolation signals affecting containment isolation valves in more
than one system or multiple main steam isolation valves (MSIVs).
(3) Emergency core cooling systems (ECCS) for pressurized water reactors (PWRs)
including: high-head, intermediate-head, and low-head injection systems and the low
pressure injection function of residual (decay) heat removal systems.
(4) ECCS for boiling water reactors (BWRs) including: high-pressure and low-pressure
core spray systems; high-pressure coolant injection system; low pressure injection function
of the residual heat removal system.
(5) BWR reactor core isolation cooling system; isolation condenser system; and feedwater
coolant injection system.
(6) PWR auxiliary or emergency feedwater system.
(7) Containment heat removal and depressurization systems, including containment spray
and fan cooler systems.
(8) Emergency ac electrical power systems, including: emergency diesel generators
(EDGs); hydroelectric facilities used in lieu of EDGs at the Oconee Station; and BWR
dedicated Division 3 EDGs.
(9) Emergency service water systems that do not normally run and that serve as ultimate
heat sinks.”

55

50.73a2i Technical Specification:
“(A) The completion of any nuclear plant shutdown required by the plant's Technical
Specifications.
(B) Any operation or condition which was prohibited by the plant's Technical Specifications
except when:
(1) The Technical Specification is administrative in nature;
(2) The event consisted solely of a case of a late surveillance test where the oversight was
corrected, the test was performed, and the equipment was found to be capable of
performing its specified safety functions; or
(3) The Technical Specification was revised prior to discovery of the event such that the
operation or condition was no longer prohibited at the time of discovery of the event.
(C) Any deviation from the plant's Technical Specifications authorized pursuant to Sec. 50.54(x)
of this part.”

7.5 Causal Analysis for Oil and Nuclear Industry Events

Now that a methodology has been constructed to classify severity of events in both the oil
and nuclear industries, the next stage involves selecting those events that fall under the most severe
categories and performing further analyses to understand what led to the occurrence of these
events.

Level 5:
56

The causes of each event will be categorized into one or more of the eight categories
identified in Chapter 6:

• Natural Disasters
• Government and Regulation
• Identical Components
• Human Influence
• Organizational Influence
• Physical Proximity
• Economic Event
• Shared Connections

7.5.1 Validation of Qualitative Data through Nuclear Experts

Because the U.S. NRC Licensee Event Reports are terse and require a technical
understanding of the operation of nuclear power plants to fully understand all the underlying
issues, and in order to validate our data, we have reached out to several renowned experts in the
nuclear industry who kindly reviewed a batch of these Licensee Event reports and answered a
series of questions to help determine the cause and compounding factors that led to the incident.
These experts range from regulatory personnel, to regional administrators, to executive
management and shift supervisors.

57

The experts will be referenced throughout as follows:
• Nuclear Expert #1
• Nuclear Expert #2
• Nuclear Expert #3
• Nuclear Expert #4
• Nuclear Expert #5
• Nuclear Expert #6
• Nuclear Expert #7

7.6 Next Steps: Risk and Vulnerability Analysis

After reviewing past event reports and determining the underlying causes of each event,
the next step is to quantify this data and perform more detailed risk and vulnerability analysis. The
analysis used will depend on what the ultimate goal is. Chapter 8 will cover the different
methodologies that can be used.

58

Chapter 8
Methodologies for Risk Analysis

In order to quantify the multi-industry interdependencies, several methodologies can be used.
These include:

• Causal-based graphical analyses: This is used to establish cause-and-effect and
understand all the contributing factors to an event occurring.
o Fault Trees are a common method used, using logical AND/OR gates.
o Bayesian Belief Networks are useful when combining both qualitative and
quantitative information.

• Parametric analyses: This is used to quantify relationships between different parameters
and understand the level of contribution to an event. This is most commonly done through
probabilities, conditional probabilities and sensitivity analysis to evaluate the effects when
one or more of the parameters varies.

• Hybrid Causal Logic analyses: This is an extension of conventional risk analyses and
combines more than one methodology, e.g. both Fault Trees and Bayesian Belief
Networks.

59

8.1 Causal-Based Graphical Analyses: Fault Trees
Fault tree analysis is a visual top-down analysis that depicts the logical relationships in a
system that contribute to an undesired state or failure of a system. This allows for a visual break-
down of the causes and events to identify critical points and weaknesses in a system. It is also
useful in determining what conditions or contributors require further evaluation. Fault tree
diagrams consist of events and logic gates with Boolean relationships, most typically AND/OR
gates.

Figure 8.1 Fault Tree Event Symbols (Ramana, 2020)

Figure 8.2 Fault Tree Gate Symbols (Ramana, 2020)
60

For example, one may construct the following fault tree for an Event A:

Figure 8.3 Fault Tree Example for Event A

The relationships in the fault tree can be represented through Boolean algebra. The laws for
Boolean algebra are as follows (Minimal cut set, 2000):

Commutative Law
𝐴∙𝐵 = 𝐵∙𝐴 (8.1)
𝐴+𝐵 = 𝐵+𝐴 (8.2)
61

Associative Law
𝐴∙(𝐵∙𝐶)=(𝐴∙𝐵)∙𝐶 (8.3)
𝐴+(𝐵+𝐶)=(𝐴+𝐵)+𝐶 (8.4)

Distributive Law
𝐴∙(𝐵+𝐶)=𝐴∙𝐵+𝐴∙𝐶 (8.5)
𝐴+(𝐵∙𝐶) =(𝐴+𝐵)∙(𝐴+𝐶) (8.6)

Idempotent Law
𝐴∙𝐴 = 𝐴 (8.7)
𝐴+𝐴 = 𝐴 (8.8)

Absorption law
𝐴∙(𝐴+𝐵)= 𝐴 (8.9)
𝐴+𝐴∙𝐵 = 𝐴 (8.10)

Once a fault tree is constructed, it is important to consider what the minimal cutsets are.
Minimal cutsets refer to the minimum set of events that lead to the failure or top event occurring.
The shorter the minimum cutset is, the more vulnerable the system is to failure. In addition, having
numerous minimal cutsets, also results in a more vulnerable system (Ramana, 2020).

62

For example, the fault tree in Figure 8.3 can be represented and reduced as follows to determine
its minimal cutsets:

Step 1: 𝐴 = 𝐵1 + 𝐵2
Step 2: 𝐴 = (𝑋1 ∙ 𝑋2) + (𝑋2 + 𝐶1)
Step 3: 𝐴 = (𝑋1 ∙ 𝑋2) + 𝑋2 + (𝑋3 ∙ 𝑋4 ∙ 𝑋5)
Step 4: 𝐴 = 𝑋1 ∙ 𝑋2 + 𝑋2 + 𝑋3 ∙ 𝑋4 ∙ 𝑋5
Step 5: 𝐴 = 𝑋2 + 𝑋3 ∙ 𝑋4 ∙ 𝑋5

Step 1 represents the top event, Event A in terms of its two child events, B1 and B2. Step
2 represents the expressions for these two events B1 and B2 in terms of their child events, X1 and
X2, X2 and C1, taking into consideration the AND gate associated with B1 and the OR gate
associated with B2. Step 3 is a further expansion of C1, the AND gate and events X3, X4, X5.
Now that the expressions are in terms of all the lower events (basic events), in Step 4, each term
in the expression represents a cut-set. The expressions can be reduced further using the Boolean
laws. 𝑋1 ∙ 𝑋2 + 𝑋2 can be reduced to X2 using the absorption law in Eq 8.10. Step 5 cannot be
reduced further, and therefore this is the minimal cut-set of the fault tree. This means that the
occurrence of one of these terms (X2 or 𝑋3 ∙ 𝑋4 ∙ 𝑋5) will trigger the occurrence of the top event
in the fault tree.

63

This can be represented in a new fault tree as follows:

Figure 8.4 Minimal Cut-set Fault Tree Example for Event A

The frequency or probability of the top event, Event A can be represented in terms of the
probability of the minimal cut-sets as follows:

𝑃
:
≅∑(𝑃
=
)
=
(8.11)

where i is the number of minimal cut sets.

64

8.2 Causal-Based Graphical Analyses: Bayesian Belief Networks

A Bayesian Belief Network is a graphical acyclic model that consists of nodes and edges.
Nodes represent a variable, while the edges represent the relationship between the connecting
variables. Bayesian Belief Networks are useful when there is a lack of precise data, because it
allows for subjective data or “beliefs” about certain variables (Brownlee, 2020).

For example, if we had three variables A, B and C, where A is dependent on B and C is
dependent on B, we can generate the following Bayesian Network:

Figure 8.5 Bayesian Network Example (Brownlee, 2019)

B could be a fire, while A is smoke, and C is a fire alarm being set off, for example.

Because A and C are both conditionally dependent on B, we can represent their dependencies as:

𝑃(𝐴|𝐵): 𝑃𝑟𝑜𝑏𝑎𝑏𝑖𝑙𝑖𝑡𝑦 𝑜𝑓 𝐴 𝑔𝑖𝑣𝑒𝑛 𝐵 (8.12)
𝑃(𝐶|𝐵): 𝑃𝑟𝑜𝑏𝑎𝑏𝑖𝑙𝑖𝑡𝑦 𝑜𝑓 𝐶 𝑔𝑖𝑣𝑒𝑛 𝐵 (8.13)
65

We also note that A and C are independent from each other, and therefore their
conditional dependencies on each other in the presence of their parent node, B, will simply be
equal to their conditional dependency on B, as follows:

𝑃(𝐴|𝐶,𝐵) = 𝑃(𝐴|𝐵) (8.14)
𝑃(𝐶|𝐴,𝐵) = 𝑃(𝐶|𝐵) (8.15)

The joint probability of A and C|B can be represented as:

𝑃(𝐴,𝐶|𝐵) = 𝑃(𝐴|𝐵) ∗ 𝑃(𝐶|𝐵) (8.16)

while the joint probability of A, B and C can be represented as:

𝑃(𝐴,𝐵,𝐶) = 𝑃(𝐴|𝐵) ∗ 𝑃(𝐶|𝐵) ∗ 𝑃(𝐵) (8.17)

Bayesian Belief Networks can be very useful when the objective is to understand and
evaluate the relationships between events when events are conditioned on a series of other events
and the data available is in different forms e.g. both quantitative and qualitative data.

The classical approach to probability considers n sample events in a sample space, S, with
each event having equal likelihood of occurring, e.g. rolling a dice. Event A can therefore be
expressed as follows:
𝑃𝑟(𝐴)=
OPQRST UV W=QSX : YZO UYYPT
WUWZ[ OPQRST UV UPWYUQSX
=
O
\
O
(8.18)
66

Empirical probability considers past events or observed occurrences, e.g. number of times an
equipment failed to start, and can be represented as follows:

𝑃𝑟(𝐵)=
OPQRST UV W=QSX ] UYYPTS^
WUWZ[ OPQRST UV WT=Z[ X
(8.19)

When little or no data of past occurrences is available, a probability can be assigned
subjectively. This is based on an individual or group of individuals’ beliefs of the probability of
an event occurring, given a certain degree of knowledge e.g. probability of an earthquake in the
next 10 years. For an event C, this can be expressed as follows:

Pr(𝐶|𝐾𝑛𝑜𝑤𝑙𝑒𝑑𝑔𝑒) (8.20)

This subjective probability can be updated, as more data becomes available. For example, if an
expert has access to data, X1, which changes his/her belief about the probability of event C, Bayes
formula can be used to update the belief, given the new information, as follows:

Pr(𝐶|𝑋
d
) =Pr(𝐶)
ef(g
h
|i)
ef (g
h
)
(8.21)

Taking into account this new evidence in addition to the expert’s prior belief in the event,
is referred to as posterior probability. This posterior probability Pr(𝐶|𝑋
d
) can now be assumed to
replace the prior probability Pr(𝐶). As more data becomes available, this posterior probability can
be updated again and so on.
67

For example, if Y1 becomes available and changes the expert’s belief in the probability,
the expert’s posterior probability can be updated as follows:

Pr(𝐶|𝑋
d
∩𝑌
d
)=𝑃𝑟(𝐶) .
ef(g
h
|i)
ef (g
h
)
.
ef(l
h
|i)
ef (l
h
)
(8.22)

Bayesian Belief Networks have been a useful tool in Civil Engineering to evaluate complex
relationships during construction projects, as well as in connection with structural health and
condition monitoring. An example of this is the Z24 bridge that was located between Bern and
Zurich in Switzerland and has been the subject of multiple research studies as a result of the large
dataset available from a long-term continuous monitoring test that was undertaken the year before
the bridge was demolished. This included multiple sensors to measure temperature, humidity,
weather conditions, wind speed and direction. Extensive studies on the Z24 bridge and other
bridges have been conducted through Bayesian Belief networks to evaluate the complex
contributing factors and to evaluate and predict physical responses such as displacement, strain or
stress (Imran, Chryssanthopoulos & Sathananthan, 2015; Liu & Mrad, 2013; Odimabo, Odouza &
Suresh, 2017).

Bayesian Belief Networks have also increasing been used in recent years with respect to
analysis in the oil and nuclear industries to assess safety and quantify the probability of failure of
specific components or systems in these industries (Chen, Yang & Sun, 2010; Zerrouki & Smadi,
2017).

68

8.3 Hybrid Causal-Logic Analyses

Hybrid causal logic analyses are useful when dealing with uncertain interactions within
events in the system being analyzed and data limitations, as it combines different risk assessment
methods. In this case we will focus on combining the two aforementioned methods – Fault Trees
and Bayesian Belief Networks (Groth, Wang, & Mosleh, 2010).

Figure 8.6 Hybrid Causal Logic System Example (Groth et al, 2010)

Figure 8.6 provides an example of what this may look like. Different fault trees may be
generated for analysis of a system, but due to data limitations some of the lower-level nodes might
not have sufficient data or information to generate probabilistic assessment.

69

These nodes are then extracted and developed further into a Bayesian Belief Network to
evaluate their relations with other factors in the system, and to be able to derive an estimate for
their probability of occurrence. This can then be inserted back into the fault tree diagram and
analysis of the fault tree diagram can continue. This also allows for the introduction and
implementation of regression-based techniques into the system (Mohaghegh, Kazemi, & Mosleh,
2009).

This is especially useful in risk assessment when some relations are more difficult to
quantify due to the nature of the qualitative information available, as is the case with examining
safety culture or organizational culture in a complex system.

70

Chapter 9

Categorizing Data and Identifying Severity
in Offshore Oil Platforms

In this stage we will be analyzing the historical data for offshore oil operations in the Outer
Continental Shelf (OCS) provided by the Bureau of Safety and Environmental Enforcement
(BSEE), due to the limitation of publicly available data from the Persian/Arabian Gulf. The data
will be summarized and categorized based on severity and identified causes and compounding
factors that led to each incident, into one of the following potential multi-industry failure categories
presented in Chapter 6 above:

• Natural Disasters
• Government and Regulation
• Identical Components
• Human Factors
• Organizational Factors
• Physical Proximity
• Economic Event
• Shared Connections

9.1 Oil Industry Data – Bureau of Safety and Environmental Enforcement

A 10-year span of data from incidents in the oil industry will be analysed. However, data
from 2018 and onwards is not publicly available as of the date of this research analysis, therefore
71

data from 2007-2017 will be used (BSEE, 2020). A summary of all incidents reported in this
timeframe is as follows:
Table 9.1. Summary of BSEE Data on Incidents in Offshore Oil Platforms in the OCS (BSEE, 2020)
Fiscal
Year
Collisions Evacuations
& Musters
Fatalities Fires &
Explosions
Gas
Releases
Injuries Lifting Loss of
Well
Control
2017 11 53 0 73 16 150 126 0
2016 9 50 2 86 17 150 155 2
2015 9 70 1 105 21 206 163 3
2014 0 52 2 135 21 285 210 5
2013 21 68 4 116 21 276 197 8
2012 13 48 1 132 27 280 167 3
2011 11 36 3 113 17 221 110 5
2010 14 31 12 134 20 253 118 4
2009 26 55 4 148 33 260 243 7
2008 28 43 12 141 22 263 185 7
2007 26 33 5 145 14 322 180 6
TOTAL 168 539 46 1328 229 2666 1854 50

The BSEE provides more detailed data on each incident for the years 2013-2017 which
includes location of incident, summary of incident, type of rig, equipment in use and other data.
This data will be analyzed in more detail to provide a foundation to quantify probability of
certain incidents occurring.

The areas of concern include collisions, evacuations and musters, fatalities, fires and
explosions, gas releases, and loss of well control. Lifting and injuries will not be included in this
analysis as these are determined to be individual smaller scale incidents occurring in an area of the
plant, and the larger scale incidents are captured in the other categories.

Some incidents may span more than one classification, for example, an explosion that leads
to a fatality is included under an explosion incident and fatality incident. All incidents under each
72

classification will be summarized and included initially, and then duplicative entries will be
disregarded.
Each incident between 2013 – 2017 is categorized in terms of consequences and assigned
a severity category, based on the categories presented in Chapter 7. The following table presents
examples of the classifications and breakdowns assigned to two events that occurred on January
23
rd
2015 and November 8
th
2016:

Table 9.2. Example of Categorization of Collision Incidents (BSEE, 2020)
2017 Report
(Total Collisions: 11)
Date Location Structure
Type
Consequences Summary
Jan
23
rd

2015
Gulf of
Mexico,
Houma
Fixed Leg Financial Cost >$500,000,000 Category 4 At approximately 0430
hours on 23-January-2015,
an offshore supply vessel
(OSV) struck an unmanned
Energy XXI production
platform located at OCSG
1443, South Timbalier 27
IA. Ninety percent of the
structure was destroyed as
a result of the collision and
subsequent fire. Three
vessels in the area
responded and assisted in
extinguishing the fire. Prior
to the accident there were
three producing gaslift
wells on the structure, with
an average total daily
production of 92 barrels of
oil, 93 barrels of water, and
115 million cubic feet(mcf)
of gas per day
Life & Health Injuries: 0
Fatalities: 0
N/A
Environment Significant Impact Category 2
Unavailability 90% Destroyed Category 5
Nov
8
th

2016
Gulf of
Mexico,
New
Orleans
Fixed Leg Financial Cost >$175,000 Category 4 During Personnel transfer,
the M/V Chad Michael
contacted the South boat
landing causing damage to
the landing
Life & Health Injuries: 0
Fatalities: 0
N/A
Environment None noted N/A
Unavailability Few weeks Category 3

73

It is important to re-iterate that the classification of categories will depend on the
stakeholders involved and the aim of the study and will need to be established prior with
justifications for the breakdown.
i. Collisions in Offshore Oil Platforms

In summary the following number of incidents in each category are determined to be as follows:

Table 9.3. Summary of Consequence Severity of Collision Incidents
Consequence Category No. of Incidents Percentage
Financial Cost None 0 0 %
1 1 2 %
2 0 0 %
3 1 2 %
4 21 42 %
5 27 54 %
Life & Health None 50 100 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 0 0 %
Environment None 44 88 %
1 0 0 %
2 1 2 %
3 3 6 %
4 2 4 %
5 0 0 %
Unavailability None 0 0 %
1 1 2 %
2 3 6 %
3 16 32 %
4 15 30 %
5 15 30%

ii. Evacuations & Musters in Offshore Oil Platforms

Similarly, for evacuations and musters the following split of categorization is identified for the
293 incidents that occurred between 2013-2017:

74

Table 9.4. Summary of Consequence Severity of Evacuation & Muster Incidents
Consequence Category No. of Incidents Percentage
Financial Cost None 93 31.7 %
1 0 0 %
2 0 0 %
3 0 0 %
4 1 0.34 %
5 200 68.3 %
Life & Health None 283 96.6 %
1 0 0%
2 0 0 %
3 0 0 %
4 0 0 %
5 10 3.41 %
Environment None 179 61.1 %
1 0 0 %
2 0 0 %
3 3 1.0 %
4 0 0 %
5 111 37.9 %
Unavailability None 0 0 %
1 277 94.5 %
2 12 4.1 %
3 3 1.0 %
4 0 0 %
5 1 0.34 %

iii. Fatalities in Offshore Oil Platforms

For fatalities the following summary categorization is identified for the 7 incidents that occurred
between 2013-2017:

Table 9.5. Summary of Consequence Severity of Fatality Incidents
Consequence Category No. of Incidents Percentage
Financial Cost None 4 57 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 3 43 %
Life & Health None 0 0 %
1 0 0 %
2 0 0 %
3 7 100 %
4 0 0 %
5 0 0 %
75

Environment None 7 100 %
1 0 00 %
2 0 0 %
3 0 0 %
4 0 0 %
5 0 0 %
Unavailability None 7 100 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 0 0%

iv. Fires & Explosions in Offshore Oil Platforms

For fires and explosions, only the incidents classified by BSEE as minor, major or
catastrophic were considered. Other incidents, most commonly classified as Incidental were
eliminated as these were very minor incidents with relatively no consequences recorded. The
following consequence categories are determined for those identified incidents of the 515 incidents
that occurred between 2013-2017:

Table 9.6. Summary of Consequence Severity of Fire and Explosion Incidents
Consequence Category No. of Incidents Percentage
Financial Cost None
1 0 0 %
2 2 0.38%
3 3 0.58%
4 4 0.77 %
5 13 2.5 %
Life & Health None
1 0 0 %
2 1 0.19 %
3 6 1.16 %
4 0 0 %
5 3 0.58 %
Environment None
1 0 0 %
2 2 0.38 %
3 1 0.19 %
4 6 1.16 %
5 5 0.97 %
Unavailability None
1 1 0.19 %
2 3 0.58%
76

3 3 0.58 %
4 4 0.77 %
5 5 0.97 %

v. Gas Releases in Offshore Oil Platforms

The following is a summary of the consequence categories identified for the 96 recorded
gas releases that were reported in 2013-2017:

Table 9.7. Summary of Consequence Severity of Gas Release Incidents
Consequence Category No. of Incidents Percentage
Financial Cost None 4 4.16 %
1 0 0 %
2 0 0 %
3 0 0 %
4 2 2.1 %
5 90 93.8 %
Life & Health None 93 96.9 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 3 3.1 %
Environment None 10 10.4 %
1 75 78.1 %
2 0 0 %
3 2 2.1 %
4 9 9.4 %
5 75 78.1 %
Unavailability None 1 1.0 %
1 3 3.1 %
2 0 0 %
3 2 2.1 %
4 7 7.3 %
5 83 86.5 %

vi. Loss of Well Control

The following is a summary of the consequence categories identified for the 19 recorded
loss of well control incidents that were reported in 2013-2017:

77

Table 9.8. Summary of Consequence Severity of Loss of Well Control Incidents
Consequence Category No. of Incidents Percentage
Financial Cost None 2 10.5 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 17 8.4 %
Life & Health None 18 94.7 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 1 55.3 %
Environment None 10 52.6 %
1 0 0 %
2 0 0 %
3 5 26.3 %
4 0 0 %
5 4 21 %
Unavailability None 19 100 %
1 0 0 %
2 0 0 %
3 0 0 %
4 0 0 %
5 0 0%

9.2 Extracting High Severity Events

Now that severity consequences of events have been established for offshore platform
incidents, this will be used as a basis to identify which events are considered high severity and will
be used for further analysis. The following guidelines will be used:

• Financial cost: A Category 1 or 2 level incident will be considered to have the potential to
result in a multi-industry event, if occurring in the Gulf, as oil, desal and nuclear operations
in the Gulf are government owned and an expenditure of over $10 million in one industry
could impact financing and decisions of the other two.
• Life & Health: A Category 1 or 2 level incident will be considered.
78

• Environment: A Category 1 or 2 level incident will be considered to have the potential to
result in a multi-industry impact, due to widespread contamination of the water potentially
curtailing production in nearby plants.
• Unavailability: This aspect is less indicative of external scale and impact of incident and
is captured in the above three areas, and therefore will be disregarded when identifying
potential multi-industry failures.

The following is a summary of potential multi-industry events in offshore oil platforms from
BSEE data, identified using the guideline above:

Table 9.9. Summary of Identified Potential Multi-Industry Events
Undesired Event High Severity Events for
Further Evaluation
Percentage of Undesired
Event (%)
Collision 1 2
Evacuations & Musters 0 0
Fatalities 0 0
Fires & Explosions 2 0.38
Gas Releases 0 0
Loss of Well Control 0 0

In the case of collision data of offshore oil operations from 2013-2017, one incident is
identified as severe and an incident that could affect multiple industries should certain conditions
exist e.g. proximity, shared connections. In addition, there are two events under Fires & Explosions
that are also determined to be severe. One of the two identified events is in fact the same event
where collision occurred, and subsequently led to a fire.

The two individual events will be evaluated in more detail, identifying which of the eight
categories contributed to each event and could lead to a potential multi-industry event.
79

Table 9.10. Potential Multi-Industry Risk for Collision Data

Jan
23
rd

2015
Gulf of
Mexico,
Houma
Fixed
Leg
Financial Cost >$500,000,000 Category
1
At approximately 0430 hours on 23-
January-2015, an offshore supply
vessel (OSV) struck an unmanned
Energy XXI production platform
located at OCSG 1443, South
Timbalier 27 IA. Ninety percent of
the structure was destroyed as a
result of the collision and
subsequent fire. Three vessels in the
area responded and assisted in
extinguishing the fire. The Bureau
of Safety and Environmental
Enforcement (BSEE) and the United
States Coast Guard (USCG) were
notified. Prior to the accident there
were three producing gaslift wells
on the structure, with an average
total daily production of 92 barrels
of oil, 93 barrels of water, and 115
million cubic feet(mcf) of gas per
day.
Life
& Health
Injuries: 0
Fatalities: 0
N/A
Environment Significant
Impact
Category
2
Unavailability 90% Destroyed Category
1

The following four categories are factors that could contribute to potentially creating a multi-
industry event if an incident of similar scale were to occur in the Persian/Arabian Gulf:

• Organizational Influences: There are several areas of consideration with regards to
organizational influences e.g.
o Was the operator fatigued, overworked?
o Was there another operator present?
o Was there clear guidance, instructions? Etc.
• Human Influences: It is important to understand what human influences may have played
a role in this incident e.g.:
o Was the operator unfamiliar with the area?
o Was the operator following protocol? Etc.
80

• Physical Proximity: This is important to consider in the Gulf when there are a plethora of
oil platforms, desalination plants and soon nuclear reactors in the Gulf, in close proximity
to each other. This could lead to a set of cascading events in the Gulf that may not occur
elsewhere.
• Economic Event: An event of this scale, may have financial repercussions that not only
impact the industry the event occurred in, but potentially other industries when financial
sources are linked.

There are different methods to analyze this event using risk methodologies presented in
Chapter 8, dependent on what the focus of the question is. Some examples of further analysis that
could be undertaken are the following:

• This event occurred early morning at 0430 while it was still dark. Did this play a role in
the event?
o Is there a correlation between collisions and time of incident, day/night?
• Is there a relationship between collision and the number of hours the operator has worked,
fatigue?
• What are the factors that led up to the event? Was the vessel off course? Did the operator
realize? Was the operator aware that a collision was going to occur before it occurred?
What steps did the operator take?
• Given a collision occurs, what is the probability that a fire ensues?

81

Table 9.11 Potential Multi-Industry Risk for Fire Data

July
23
rd

2013
Gulf of
Mexico,
Houma
Caisson Financial
Cost
>$10,000,000 Category
2
“On July 23, 2013, Walter Oil & Gas
Corporation (“Walter”) was completing a
well located at the South Timbalier Block
220 (ST 220), using a jack up rig owned by
Hercules Offshore, Inc. (“Hercules”). The
drill crew was in the process of removing
drill pipe from the well (known as
“tripping out”). At approximately 8:40
a.m., an undetected influx of hydrocarbons
into the well
(commonly referred to as a “kick”)
escalated to a blowout. High pressure
natural gas flowed uncontrollably through
the blow out preventer stack (BOP) which
was mounted at the surface beneath the
drill floor of the rig. Despite attempts to
control the well with the BOP, the natural
gas continued to flow, forcing the rig crew
of 44 to evacuate using the rig’s life boats.
Some crew members suffered minor
injuries during the blowout, and all crew
members were recovered from the life
boats within minutes of the evacuation by a
service vessel that was in the area.”
Life
& Health
Injuries: Few
Fatalities: 0
Category
3
Environment Gas Leak Category
2
Unavailability Months Category
2

Note that this second severe event occurred in the same region as the prior event.

It is again important to consider physical proximity and the economic impacts of this event
to other industries that may be located close by, had this event occurred in the Persian/Arabian
Gulf, for similar reasons as the prior event. This event also requires a more detailed analysis to
understand what role organizational and human influences may have played a part in. Some
questions that this event could bring up for more analysis include:

• Is there a correlation with this region and occurrences of incidents?
• What are the contributing factors that led to the occurrence of this event?
o Was protocol followed?
o Was there any indication that a kick was probable?
82

• What were the reactive measures when the kick occurred?
• Was there an equipment failure or technical malfunction?

Determining which question(s) a stakeholder or researcher would like to address is a critical
initial step, as this sets the foundation for analysis where the key objective should be to eliminate
or mitigate risk. By understanding the contributing factors and vulnerabilities that increase the
probability of an incident, risk mitigation strategies can be implemented to minimize these
vulnerabilities. Some examples of this further analysis will be presented in the following chapter.

83

Chapter 10

Extension of Risk Analysis for Offshore Oil Operations

After assessing and categorizing severity of events reported between 2013-2017 of offshore
oil operations in the Outer Continental Shelf (OCS) through the Bureau of Safety and
Environmental Enforcement (BSEE), due to the limitation of publicly available data from the
Persian/Arabian Gulf, we identified two events of high severity that occurred in the Gulf of Mexico
and that have the potential of causing multi-industry impact, should a similar event occur in the
Persian/Arabian Gulf. After identification of such an event, it is important to understand what
contributed to this event and what additional analysis can be performed that will help with
identification of vulnerabilities and implementation of strategies to mitigate risk.

Let’s consider the following event:

Table 10.1 Potential Multi-Industry Event (BSEE, 2020)
July
23
rd

2013
Gulf of
Mexico,
Houma
Financial
Cost
>$10,000,000 Category
2
“On July 23, 2013, Walter Oil & Gas Corporation
(“Walter”) was completing a well located at the
South Timbalier Block 220 (ST 220), using a jack
up rig owned by Hercules Offshore, Inc.
(“Hercules”). The drill crew was in the process of
removing drill pipe from the well (known as
“tripping out”). At approximately 8:40 a.m., an
undetected influx of hydrocarbons into the well
(commonly referred to as a “kick”) escalated to a
blowout. High pressure natural gas flowed
uncontrollably through the blow out preventer stack
(BOP) which was mounted at the surface beneath
the drill floor of the rig. Despite attempts to control
the well with the BOP, the natural gas continued to
flow, forcing the rig crew of 44 to evacuate using the
rig’s life boats. Some crew members suffered minor
injuries during the blowout, and all crew members
were recovered from the lifeboats within minutes of
the evacuation by a service vessel that was in the
area.”
Life
& Health
Injuries: Few
Fatalities: 0
Category
3
Environment Gas Leak Category
2
Unavailability Months Category
2

84

The BSEE produced an investigation report for this event and detailed the chronological events
that took place leading up to the blowout. The details of the event are as follows (BSEE Panel,
2015):

• On July 23, 2013, the drill crew was completing a well for Walter Oil & Gas Corporation,
using the Hercules Offshore MODU Hercules 265. They were preparing to remove drill
pipe from the well (“tripping out”).
• 22.6bbl of brine was used to fill the trip tank
• Casing annulus pressure was increased to 1,340 psi.
• The top of the drill string was lifted up 5ft.
• The bypass in the packer opened and 15.7ppg completion fluid flowed below packer.
• Formation pressure became overbalanced.
• The annulus loss rate became higher than the trip tank pump rate.
• The trip tank pump rate was increased to 5.2bpm.
• One minute later the well was filled.
• The bypass in the packer was opened and closed three times in the next minute, to calculate
average loss rate.
• The Company Man and Completions Engineer conversed and decided to cut the fluid
density by 0.4ppg to 15.3ppg. They did not consider bottom hole temperature.
• It was then agreed to use a 20 bbl hydroxyl ethyl cellulose (HEC) gel pill as a fluid loss
control agent.
• 20.9bbl of 15.3ppg brine was circulated into the well.
• Pumping was stopped and flow was checked.
85

• Well wasn’t flowing so Rig Personnel concluded that the hydrostatic pressure created by
the brine was greater than formation pressure.
• Brine circulation continued until well was filled with ~1,300bbl.
• 20 bbl HEC gel pill was also circulated to the bottom of the drillpipe.
• Bypass was opened, and loss rate was measured around ~157bph until HEC pill reached
the formation and loss rate started decreasing until ~30bph.
• Bypass was closed, trip tank was filled with 17.9bbl and bypass was opened.
• Loss rate was measured several times over a couple of hours and kept gradually decreasing
until ~1.8bph.
• Company Man and Completions Engineer determined that the loss rate was adequate and
tripping could commence.
• Company Man proposed cutting completion fluid density to 15.1ppg to fill the well as the
work string is tripped. Completions Engineer agreed. Both did not consider the effect of
bottom hole temperature.
• Work string was pulled up 90 ft, filling of trip tank with brine began.
• Tripping commenced, and seepage losses were calculated multiple times throughout the
process.
• Pipe pulling speed was increased.
• 6AM: The Toolpusher and Company Man shift changed and debriefed the next rotation.
• Driller, Fluid Engineer and Floorhand stated they were checking fluid losses every 5 stands
and nothing was out of the ordinary. However, recorded data shows no pause in activity
every 5 stands.
86

• Tripping operations were paused to change equipment from 5-in handling equipment to 3
½ in equipment. Slips were changed but top-drive pin cross-over sub was not changed.
• During this time trip tank volume increased, but it either went unnoticed or was considered
insignificant. This was a warning sign of loss of well control.
• Pipe pulling commenced, trip tank volume and flow out indicator had significant increases.
• Pulling continues and trip tank overflows.
• Well flowed out of the top of drill pipe.
• Once well flowed, it made it impossible for rig-floor crew to follow procedure to control
kick. Completion fluid rained down on crew burning skin and eyes.
• There were no alternative procedures as part of protocol.
• Crew attempted to install safety valve but force of fluid and difficult to access location
made it impossible.
• Attempt was made to use top drive unit to push work string down to help with installation
of safety valve but top drive pin assembly was not the correct 3 ½ inch.
• Flow casing pressure increased to over ~1200psi.
• All crew members evacuated the platform, after several failed attempts to control the flow.
• The flow continued for 13 hours, then ignited and burned for 2 days, at an estimate flow
rate of up to 400 million cubic feet of natural gas per day.

10.1 Fault Tree Construction

After evaluating the detailed report of the events that took place, we can construct a fault
tree, as presented in Figure 10.1 to analyze the contributing factors to the event. Wang, Liu, Jiang,
87

Khan, & Wang (2019) analyzed historical accidents that were specifically fire-related and reported
to BSEE between 1976 – 2015. This constituted 2,837 events which were analyzed and the
probabilities of various causes that contributed to these events were determined and are presented
in Table 10.2. This historical data of probabilities will be used as a basis for our analysis to
determine the probabilities of the contributing causes in our fault tree and allow us to evaluate and
deduce the probabilities of the various fault tree events.

Table 10.2 Probability of primary events (Wang et al, 2019)

88

Figure 10.1 Fault Tree for Gulf of Mexico Blowout July 23
rd
2015
89

10.2 Fault Tree Analysis

The first stage of this analysis will consist of determining the individual probabilities of
each event in the fault tree occurring and subsequently the overall top event probability. This will
be achieved using the basic event probabilities extracted from Table 10.2:

Table 10.3 Basic Event Probabilities
Event Description Probability (10
6
h)
High Pressure Gas 1.5e-2
Well Seepage Losses 2.7e-3
Violation of Operation Procedure 1.7e-4
Insufficient Safety Check 2.5e-2
Poor Safety Supervision 4.6e-4
Gas Cut Mud 3e-5
Knowledge 1.2e-3
Experience 1.1e-3
Training 1.89e-3
Drilling Procedure 7e-4

Using the basic event probabilities, the intermediate event probabilities and subsequently
the top event probability can be calculated with the assumption of mutually exclusive events:
Table 10.4 Probabilities of Intermediate Events
Event Description Probability
Missed Trip Tank Volume Dramatic Increases 1.7e-4 + 2.5e-2 + 4.6e-4 = 0.02563
Missed Flow-Out Indicator Dramatic Increases 2.5e-2 + 4.6e-4 = 0.02546
Missed Early Detection 0.02563 • 0.02546 = 0.00065
Incorrect Calculation of Density 1.2e-3 + 1.1e-3 + 1.89e-3 = 0.00419
Insufficient mud Density 0.00419 + 3e-5 = 0.00422
Fast Pulling of Drill String 7e-4 + 4.6e-4 = 0.00116
Swabbing 0.00116
Insufficient Drilling Mud Pressure 2.7e-3 + 0.00422 + 0.00116 = 0.008
Blowout 0.00065 • 1.5e-2 • 0.008 = 7.8e-8

Through this analysis gate-by-gate we determine the probability of blowout stemming from
the series of events aforementioned, to be 7.8e-8 10
6
h. Because the minimal cut sets are not
independent (i.e. the same basic event belongs to more than one cut set), the probability of the top
event is an overestimate, and therefore we can approximate that the probability is more correctly
defined as < 7.8e-8 10
6
h.
90

To understand the significance of the series of events that occurred and their implications,
it is important to determine and evaluate the cut sets of the fault tree and ultimately its minimal cut
sets. These are the minimum series of events that can lead to the occurrence of the top event. This
also allows for repeated events to be eliminated so that the same basic event is not introduced into
analysis more than once, and a more accurate representation of the top event probability can be
determined.

For ease of calculation the fault tree elements will be referenced using letters and numbers
corresponding to their location in the fault tree from top to bottom and left to right. The references
that will be used are presented in Table 10.5. Any repeated events will only be assigned one
reference.

Table 10.5 Fault Tree Event References
Reference Event Description
A Blowout
B1 Missed Early Detection
B2 High Pressure Gas
B3 Insufficient Drilling Mud Pressure
C1 Missed Trip Tank Volume Dramatic Increases
C2 Missed Flow-Out Indicator Dramatic Increases
C3 Well Seepage Losses
C4 Insufficient mud Density
C5 Swabbing
D1 Violation of Operation Procedure
D2 Insufficient Safety Check
D3 Poor Safety Supervision
D4 Gas Cut Mud
D5 Incorrect Calculation of Density
D6 Fast Pulling of Drill String
E1 Knowledge
E2 Experience
E3 Training
E4 Drilling Procedure

91

The identification of minimal cutsets will be determined by evaluating the entire system as a
Boolean expression:

A = B1 •B2 • B3
A = (C1 • C2) • (B2) • (C3 + C4 + C5)
A = ((D1 + D2 + D3) • (D2 + D3)) • (B2) • (C3 + (D4 + D5) + D6)
A = ((D1 + D2 + D3) • (D2 + D3) • (B2) • (C3 + (D4 + (E1 + E2 + E3)) + (E4 + D3))
A = B2 • (D1 • D2 + D1 • D3 + D2 • D2 + D2 • D3 + D3 • D2 + D3 • D3) • (C3 + D4 + E1 + E2
+ E3 + E4 + D3)

Idempotent Rule: D2 • D2 = D2 and D3 • D3 = D3
Rule of Absorption: D2 • D3 + D3 • D2 = D3 • D2 = D2 • D3

A = B2 • (D1 • D2 + D1 • D3 + D2 + D2 • D3 + D3) • (C3 + D4 + E1 + E2 + E3 + E4 + D3)

Expanding this expression:
A = B2 • (D1 • D2 • C3 + D1 • D2 • D4 + D1 • D2 • E1 + D1 • D2 • E2 + D1 • D2 •E3 + D1 •
D2 •E4 + D1 • D2 •D3 + D1 • D3 • C3 + D1 • D3 • D4 + D1 • D3 • E1 + D1 • D3 • E2 + D1 •
D3 •E3 + D1 • D3 •E4 + D1 • D3 •D3 +
D2 • C3 + D2 • D4 + D2 • E1 + D2 • E2 + D2 •E3 + D2 •E4 + D2 •D3 +
D2 • D3• C3 + D2• D3 • D4 + D2 • D3• E1 + D2 • D3• E2 + D2• D3 •E3 + D2• D3 •E4 + D2•
D3 •D3 +
D3 • C3 + D3 • D4 + D3 • E1 + D3 • E2 + D3 •E3 + D3 •E4 + D3 •D3)
92

Idempotent Rule and Rule of Absorption again:
A = B2 • (D2 • C3 + D2 • D4 + D2 • E1 + D2 • E2 + D2 •E3 + D2 •E4 +D3)

This leads us to the following identified cut sets:

Table 10.6 Minimal Cut Sets Identified
Minimal Cutset Reference Basic Events
MC1 B2 • D2 • C3
MC2 B2 • D2 • D4
MC3 B2 • D2 • E1
MC4 B2 • D2 • E2
MC5 B2 • D2 • E3
MC6 B2 • D2 • E4
MC7 B2 • D3

The next step is to calculate the probabilities of these minimal cut sets occurring and
determine their cut set importance. The cut set importance is a measure of each cut sets probability
relative to the top event probability.

Table 10.7 Minimal Cut Sets Identified
Minimal Cut Sets Probability of Cut Set Cut Set Importance (%)
MC1 = B2 • D2 • C3 1.5e-2 • 2.5e-2 • 2.7e-3 = 1.01e-6 1.04
MC2 = B2 • D2 • D4 1.5e-2 • 2.5e-2 • 3e-5 = 1.125e-8 11.5
MC3 = B2 • D2 • E1 1.5e-2 • 2.5e-2 • 1.2e-3 = 4.5e-7 4.6
MC4 = B2 • D2 • E2 1.5e-2 • 2.5e-2 • 1.1e-3 = 4.125e-7 4.2
MC5 = B2 • D2 • E3 1.5e-2 • 2.5e-2 • 1.89e-3 = 7.09e-7 7.27
MC6 = B2 • D2 • E4 1.5e-2 • 2.5e-2 • 7e-4 = 2.625e-7 2.7
MC7 = B2 • D3 1.5e-2 • 4.6e-4 = 6.9e-6 70.7
Total ∑𝑀𝐶
=
= 9.755e-6 100

Through minimal cut set analysis, we determine the top event frequency ∑𝑀𝐶
=
= 9.755e-6
which is less than what was calculated above using gate-to-gate analysis, as expected due to the
repeated basic events being eliminated. The most significant cut set we determine is MC7 = B2 • D3,
93

which relates to the presence of high-pressure gas and poor safety supervision. We can understand
through the graphical representation of the fault tree that poor safety supervision plays a significant
role due to this element impacting multiple events such as swabbing and missing the early
detection warning signs.

The second contributor that plays a significant role is MC1 = B2 • D2 • D4, which relates to
the presence of high-pressure gas, insufficient safety check and gas cut mud, and the third
contributor which comes close in importance to the second is MC1 = B2 • D2 • C3 and relates to the
presence of high-pressure gas, insufficient safety check and well seepage losses.

It is important to note at this stage the commonalities across the most important cut sets
and the vulnerabilities. All three top events have some level of human influence contributing to
these events through poor safety supervision, and insufficient safety checks.

Identifying these elements and vulnerabilities is an important foundation for risk reduction
and mitigation strategies. These elements should be addressed in more detail, evaluating the
current safety checks and safety supervision in place and identifying where weaknesses within
these elements may lay. This can be done through extracting these elements out of the fault tree
generated and constructing a new fault tree or Bayesian network with these elements at the top
event and breaking it down into much more detail identifying the sub-elements that lead up to
these safety deficiencies. Historic evaluation of data to understand the contributing factors is
important to pinpoint the vulnerabilities within these elements.

94

In addition, sensitivity analysis is a useful tool to evaluate how improving certain elements
and their probabilities impact minimal cut set probabilities and as a whole the overall probability
in a system. It is also beneficial when assessing and setting goals or targets to achieve a certain
level of risk reduction.

For example, in the case above, the minimal cut set with highest importance was identified
to be MC7 = B2 • D3 with a 70.7% importance factor. This tells us this is a good candidate for further
evaluation and risk mitigation measures. The next question we might want to answer, is how
sensitive these elements are and how much improving one of them affects overall risk. Taking a
look at D3 (poor safety supervision), we can evaluate the impact implementation of better safety
checks and supervision has on the overall probability of a blowout, as shown in Figure 10.2.

Figure 10.2 Sensitivity Analysis – Poor Safety Supervision and Blowout
95

Figure 10.3 Sensitivity Analysis – Insufficient Safety Checks and Blowout
Figure 10.4 Sensitivity Analysis – Knowledge and Blowout
96

We can further evaluate D2 (Insufficient Safety Checks) and E1 (Knowledge), elements in
the next most important cut sets, and we note the much lesser impact these elements have on the
overall probability. This allows stakeholders to decide what measures are most effective to
undertake and what goals to set for risk mitigation.

This needs to be done in conjunction with analysis of the feasibility of reducing risk of
certain elements. Some elements such as the presence of natural gas are less feasible to modify
even though reduction of risk in this element may be most significant. This is due to the more
natural occurrence of this element in the environment and less of a human or organizational
influence that can potentially have an impact on this element.

It is important to assess both the impact an element has and the feasibility of regulating and
controlling an element effectively and efficiently.

10.3 Bayesian Belief Network Analysis

Bayesian Belief Networks is a valuable tool for causal analysis when limited data is
available or accessible. This network is able to capture data through joint probabilities and, in
addition, include qualitative data such as expert reasoning and judgment, to effectively
demonstrate relationships between different sets of variables and provide a foundation for risk
assessment and management through uncertainty analysis and predictive evaluation of the
implementation of changes within the system.

97

This can be used in conjunction with other methods of risk analyses to improve risk
management and the assessment of effective strategies. For example, in connection with the fault
tree above, we might want to perform further analysis on some of the elements but have limited
information available.

Consider the following element, listed above, “Poor Safety Supervision”:

Poor Safety Supervision appears three times in the overall fault tree and was identified to
be part of the most significant minimal cut set and therefore will be evaluated further.

The data available is limited to the occurrences of poor safety supervision when an event
occurs (in this case, a fire). However, data on the occurrence of a poor safety supervision
independent of an event occurring is not available. This includes poor safety supervision that leads
to a larger event and a poor safety supervision that does not have identified consequences. Because
this data is not available and may be difficult to determine as many of these instances can remain
Figure 10.5 Fault Tree Snapshot
98

undiagnosed, and because this data is still important to fully understand all potential contributing
causes, we can attempt to fill the gaps using Bayesian Belief Networks.

The first step involves creating the Bayesian Network consisting of nodes and arcs to
demonstrate the relationships between the elements under consideration potentially leading to poor
safety supervision, through a directed acyclic graph.

Figure 10.6 Bayesian Belief Network for Safety Supervision
99

The next step involves breaking down each element into categories in order to introduce
conditional probabilities in conditional probability tables for further analyses. There are different
approaches to break down the categories depending on what information is being addressed as
well as how finely to categorize data. The following breakdowns will be used:

Table 10.8 Breakdown of Categories for Safety Supervision Bayesian Network

Length of Shift
1. 12+ hours
2. 8-12 hours
3. 4-8 hours
4. < 4 hours

Time of
Shift
1. Day
2. Night

Management
Commitment
1. Strong
2. Average
3. Weak

Job Repetition
1. High
2. Low

Coworker
Influences
1. Positive
3. Negative

Safety Protocols
1. Sufficient
2. Insufficient

Fatigue
1. High
2. Low

Pressure to Get
Task Done
1. High
2. Low

Complacency
1. High
2. Low

Worker Morale
1. High
2. Low

Company
Incentives
1. High
2. Low

Safety
Supervision
1. Strong
2. Poor

Next, the conditional probabilities are introduced based on qualitative or quantitative data.
For example, when assessing a specific plant or utility, quantitative data on the lengths of shifts
and times of shifts can be determined from human resources personnel and scheduling data.
However, other factors such as fatigue during the job or coworker influences will require
qualitative data such as expert judgement or surveying of workers in the workplace. As more data
becomes available and accessible these figures can be easily updated.
100

Due to the lack of access to data for these categories, we will rely on prior industry research
presented in Smith, S. (2014), O’Dea A. and Flin R. (2001), and Parkes K. (2007) to estimate these
interactions and proceed with the example analysis. The six parent node probability tables are as
follows:

Table 10.9 Probability Tables for Six Parent Nodes in Safety Supervision Bayesian Network

Length of Shift
Category Probability
1. 12+ hours .83
2. 8-12 hours 0.15
3. 4-8 hours 0.01
4. < 4 hours 0.01

Time of Shift
Category Probability
1. Day 0.64
2. Night 0.36

Management Commitment
Category Probability
1. Strong 0.61
2. Average 0.11
3. Weak .28

Job Repetition
Category Probability
1. High .67
2. Low .33

Coworker Influences
Category Probability
1. Positive .93
2. Negative 0.07

Company Incentives
Category Probability
1. High 0.19
2. Low 0.81

The remaining nodes are child nodes, meaning they are conditional on one or more other
nodes and therefore require larger conditional probability tables. Leadership Enforcement,
Pressure to Get Task Done and Safety Protocols are child nodes of Management Commitment to
Safety and the probability tables used are as follows:

Table 10.10 Probability Table for Leadership Enforcement

Table 10.11 Probability Table for Leadership Enforcement
Leadership Enforcement
Management Commitment Strong Average Weak
Probability
High 0.91 0.62 .42
Low 0.09 .38 0.58
Pressure to Get Task Done
Management Commitment Strong Average Weak
Probability
High 0.76 0.82 .88
Low 0.24 .18 0.12
101

Table 10.12 Probability Table for Leadership Enforcement

Complacency is dependent on Management Commitment to Safety, Coworker Influences, Job
Repetition, and Fatigue, and the probability table has been constructed as follows:

Table 10.13 Probability Table for Complacency
Complacency
Coworker Infl. Positive
Fatigue High Low
Management Strong Average Poor Strong Average Poor
Job Repetition H L H L H L H L H L H L
Probability
High 0.68 0.65 0.72 0.68 0.76 0.75 0.62 0.58 0.65 0.62 0.69 0.67
Low 0.32 0.35 0.28 0.32 0.24 0.25 0.38 0.42 0.35 0.38 0.31 0.33
Coworker Infl. Negative
Fatigue High Low
Management Strong Average Poor Strong Average Poor
Job Repetition H L H L H L H L H L H L
Probability
High 0.72 0.68 0.75 0.70 0.78 0.72 0.68 0.63 0.70 0.68 0.74 0.70
Low 0.28 0.32 0.25 0.30 0.22 0.28 0.32 0.37 0.30 0.32 0.26 0.30

Fatigue is dependent upon Job Repetition, Length of Shift and Time of Shift, and the probability
table is as follows:

Table 10.14 Probability Table for Fatigue
Fatigue
Job Repetition High
Length of Shift >12 hours 8-12 hours 4-8 hours <4 hours
Time of Shift Day Night Day Night Day Night Day Night
Probability
High 0.72 0.83 0.65 0.71 0.55 0.65 0.35 0.40
Low 0.28 0.17 0.35 0.29 0.45 0.35 0.65 0.60
Job Repetition Low
Length of Shift >12 hours 8-12 hours 4-8 hours <4 hours
Time of Shift Day Night Day Night Day Night Day Night
Probability
High 0.65 0.76 0.58 0.64 0.47 0.54 0.27 0.33
Low 0.35 0.24 0.42 0.26 0.53 0.46 0.73 0.67

Safety Protocols
Management Commitment Strong Average Weak
Probability
High 0.85 0.61 .54
Low 0.15 .39 0.46
102

Worker Morale is contingent upon Fatigue, Job Repetition, Time of Shift, Length of Shift and
Company Incentives:
Table 10.15 Probability Table for Worker Morale
Worker Morale
Fatigue High
Time of Shift Day
Co. Incentives High
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.32 0.46 0.61 0.72 0.39 0.52 0.69 0.78
Low 0.68 0.54 0.39 0.28 0.61 0.48 0.31 0.22
Co. Incentives Low
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.24 0.39 0.57 0.67 0.32 0.47 0.62 0.72
Low 0.76 0.61 0.43 0.33 0.58 0.53 0.28 0.28
Time of Shift Night
Co. Incentives High
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.23 0.37 0.56 0.68 0.31 0.42 0.59 0.74
Low 0.77 0.63 0.44 0.32 0.69 0.58 0.41 0.26
Co. Incentives Low
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.19 0.31 0.51 0.61 0.26 0.39 0.53 0.66
Low 0.81 0.69 0.49 0.39 0.74 0.61 0.47 0.34

Worker Morale
Fatigue Low
Time of Shift Day
Co. Incentives High
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.36 0.52 0.69 0.78 0.43 0.61 0.74 0.83
Low 0.64 0.48 0.31 0.22 0.57 0.39 0.26 0.17
Co. Incentives Low
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.29 0.46 0.64 0.73 0.36 0.57 0.69 0.79
Low 0.71 0.54 0.46 0.27 0.64 0.43 0.31 0.21
Time of Shift Night
Co. Incentives High
103

Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.27 0.41 0.65 0.72 0.39 0.48 0.67 0.77
Low 0.72 0.59 0.35 0.28 0.61 0.52 0.33 0.23
Co. Incentives Low
Job Repetition High Low
Length of Shift >12h 8-12h 4-8h <4h >12h 8-12h 4-8h <4h
Probability
High 0.24 0.39 0.59 0.66 0.31 0.43 0.64 0.72
Low 0.76 0.61 0.41 0.34 0.69 0.67 0.36 0.28

The final node, Safety Supervision is contingent on Leadership Enforcement, Pressure to get task
done, Safety Protocols, Complacency, Fatigue, and Worker Morale.
Table 10.16 Probability Table for Safety Supervision
Safety Supervision
Fatigue High
Safety Protocol Sufficient
Pressure High Low
Enforcement Strong Weak Strong Weak
Complacency High Low High Low High Low High Low
Morale H L H L H L H L H L H L H L H L
Probability
Strong .72 .64 .76 .71 .58 .47 .66 .61 .77 .71 .83 .78 .66 .54 .76 .64
Poor .28 .36 .24 .29 .42 .53 .34 .39 .23 .29 .17 .22 .34 .46 .24 .36
Safety Protocol Insufficient
Pressure High Low
Enforcement Strong Weak Strong Weak
Complacency High Low High Low High Low High Low
Morale H L H L H L H L H L H L H L H L
Probability
Strong .65 .54 .68 .63 .49 .41 .56 .52 .71 .64 .75 .71 .58 .48 .69 .57
Poor .35 .46 .32 .37 .51 .59 .44 .48 .29 .36 .25 .29 .42 .52 .31 .43
Fatigue Low
Safety Protocol Sufficient
Pressure High Low
Enforcement Strong Weak Strong Weak
Complacency High Low High Low High Low High Low
Morale H L H L H L H L H L H L H L H L
Probability
Strong .79 .72 .82 .78 .67 .58 .73 .69 .85 .79 .91 .86 .72 .61 .81 .72
Poor .21 .28 .18 .22 .33 .42 .27 .31 .15 .21 .09 .14 .28 .39 .19 .28
Safety Protocol Insufficient
Pressure High Low
Enforcement Strong Weak Strong Weak
Complacency High Low High Low High Low High Low
Morale H L H L H L H L H L H L H L H L
Probability
Strong .74 .67 .78 .73 .62 .52 .64 .61 .79 .72 .84 .81 .67 .56 .76 .67
Poor .26 .33 .22 .27 .38 .48 .36 .39 .21 .28 .16 .19 .33 .44 .24 .33
104

These probability tables are then introduced into our Bayesian Belief Network, producing
the following representation of the relationships in Figure 10.7. This represents the general
relationship between all nodes based on the conditional probability tables that have been
introduced into the network. As new information becomes available, these nodes can be easily
updated through their probability tables. This network can be further analysed to identify risk and
probability when a certain condition is present, and to evaluate the impact and sensitivity of various
parameters.

Figure 10.7 Bayesian Belief Network for Safety Supervision

105

For example, if evidence existed of a strong Management Commitment to Safety, this can
be introduced into the network as evidence, to evaluate the relationships under such condition. In
this case, Figure 10.8 depicts that such evidence improves the probability of Sufficient Safety
Protocols and Strong Leadership Enforcement significantly with Leadership Enforcement
depicting a 91% probability of being Strong in comparison to the previous 74% probability when
no evidence of the level of Management Commitment to Safety was present. Similarly, Safety
Protocols depicts an increase from 74% to 85%. In turn, this results in the lower node probability
of safety supervision exhibiting a strong implementation, increasing from 66% to 70% probability.

Figure 10.8 Bayesian Belief Network for Safety Supervision with Evidence
of Strong Management Commitment to Safety
106

This allows for ease of analysis to identify which conditions are more sensitive to change
and which areas are good candidates for risk mitigation and improvement. In addition, more than
one condition or evidence can be introduced. For example, if a strong Management Commitment
to Safety is identified, yet Leadership Enforcement is identified as Weak, these two evidences can
be introduced to understand how these two relationships impact the overall probability of safety
supervision in the workplace.

Figure 10.9 Bayesian Belief Network for Safety Supervision with Evidence of Strong Management
Commitment to Safety and Weak Leadership Enforcement

107

This condition is presented in Figure 10.9 and we note that the presence of Weak
Leadership Enforcement despite a Strong Management Commitment to Safety has a significant
impact on the reduction of the probability of Safety Supervision, reducing it from a 70%
probability of exhibiting strong supervision, to 57%. It is important to understand how these
relationships impact each other, especially when it comes to introducing risk management
techniques, as improving one area may not be sufficient if another area is not addressed in
conjunction.

Furthermore, it is important to also evaluate more than one element in the workplace. In
this case, we focused on Safety Supervision, but other contributing elements should also be
evaluated. For example, from the above fault tree, Insufficient Safety Checks can be similarly
evaluated.

This element was identified as a contributing factor in two areas in the fault tree diagram,
and therefore we may choose to evaluate it further to understand the underlying causes that lead
to the occurrence of an insufficient safety check and the potential areas of improvement.

Figure 10.10 Insufficient Safety Check Element – Fault Tree Snapshot
108

The first step involves creating the Bayesian Network to demonstrate the relationships
between the elements potentially leading to an insufficient safety check. These relationships should
be constructed by experts, and due to the presence of subjective reasoning, will not always be
identical. For example, in the previous example we introduced Worker Morale into the system,
while in this case we did not. The categories and breakdowns may also differ, depending on the
level of refinement desired of the system.

The next step involves breaking down each element into categories in order to introduce
conditional probabilities in conditional probability tables for further analyses, similar to the
previous approach.

Figure 10.11 Bayesian Belief Network for Insufficient Safety Check
109

For the sake of this example, the following breakdowns will be used:

Table 10.17 Breakdown of Categories for Bayesian Belief Network

Length of Shift
1. 12+ hours
2. 8-12 hours
3. 4-8 hours
4. < 4 hours

Time of
Shift
1. Day
2. Night

Management
Commitment
1. Strong
2. Average
3. Weak

Job Repetition
1. High
2. Low

Coworker
Influences
1. Positive
3. Negative

Safety Protocols
1. Sufficient
2. Insufficient

Fatigue
1. High
2. Low

Pressure to Get
Task Done
1. High
2. Low

Complacency
1. High
2. Low

Worker Morale
1. High
2. Low

Job Repetition
1. High
2. Low

Insufficient
Safety Check
1. High
2. Low

Introducing conditional probability tables into our Bayesian Belief Network, produces the
following relationship:

Figure 10.12 Bayesian Belief Network with Probabilities
110

Further analysis can be done to identify risk and probability when a certain condition is
present. For example, if the condition or evidence existed of a personnel or operator who is working
a 12+ hour shift, this piece of evidence can be introduced into the Length of Shift variable, and the
conditional probabilities of the resulting nodes calculated. The child nodes will be impacted and
we note that the probability of Fatigue and in turn an Insufficient Safety Check has increased.

Additional evidence can be introduced, such as the existence of a Negative co-worker
influence, as presented in Figure 10.14, impacting Complacency and therefore an Insufficient
Safety Check. This allows for effective analysis of the different variables and their sensitivity and
Figure 10.13 Bayesian Belief Network with evidence of a 12+ hour shift
111

can be very useful when determining which variables to primarily focus on when introducing risk-
mitigation measures into the workplace.

It is also easy to update when data changes, different strategies are implemented and the
environment of the workplace evolves, by updating the conditional probability tables for the
relevant nodes.

This data can then be inserted back into the fault tree analysis or other methods of risk
analysis to understand the wider picture of what impacts this element as well as how this element
impacts the system as a whole. This allows for a feedback loop to effectively and efficiently
improve systems.

Figure 10.14 Bayesian Belief Network with evidence of a 12+ hour shift and Negative Co-worker Influence
112

This methodology can be repeated for different elements in the fault tree analysis or
different elements of interest to the plant or organization. It can be extended, categories can be
expanded, different criteria can be used, depending on the question being addressed.

This analysis will be developed further in later chapters to integrate the analysis and
evaluation of the oil industry with analysis of the nuclear industry.

113

Chapter 11

Categorizing Data and Identifying Severity in Nuclear Reactors

Data from the U.S. Nuclear Regulatory Commission in the form of Licensee Event Reports
(LERs) will be used for data analysis, since nuclear power is in its infancy in the Gulf with one
operating reactor in the region, limiting the available data in the Gulf. This data will be restricted
to data from events occurring between January 1
st
2010 to January 1
st
2020 in pressurized water
reactors, as this is the technology currently being used and introduced to the Gulf.

A total of 2911 LERs exist for this time period with 1197 in connection with pressurized
water reactors. In this section, we will focus on using the categorization for severity identified in
Section 7.4, to demonstrate the application of this methodology for Licensee Event Reports.

Categorizing this data into the established severity categories, we identify 766 LERs falling
into the most severe category (Level 1) in connection with the occurrence of a loss of safety
function, as presented in Figure 11.1. These are events that could have prevented the fulfillment
of a safety function in the reactor.

These events will be evaluated in more detail to understand the common cause failures and
vulnerabilities in the system. While these 766 LERs have been identified as the most severe LERs
and will be studied further, this doesn’t negate the necessity to study the events at varying severity
levels, to learn lessons and identify vulnerabilities in these events as well. For the sake of this
114

research and to demonstrate the methodology of studying such events, we will focus primarily on
the Level 1 Severity events. A similar methodology can be followed for the other severity levels.
The definitions for these events per the US NRC website are as follows (U.S. NRC, 2020b):

50.73a2v Prevented Safety Function:
“Any event or condition that could have prevented the fulfillment of the safety function of
structures or systems that are needed to:
(A) Shut down the reactor and maintain it in a safe shutdown condition;
(B) Remove residual heat;
(C) Control the release of radioactive material; or
(D) Mitigate the consequences of an accident.”

50.73a2vii Multiple Safety System Function:
“Any event where a single cause or condition caused at least one independent train or channel to
become inoperable in multiple systems or two independent trains or channels to become
inoperable in a single system designed to:
(A) Shut down the reactor and maintain it in a safe shutdown condition;
(B) Remove residual heat;
(C) Control the release of radioactive material; or
(D) Mitigate the consequences of an accident”
115

Figure 11.1 Severity Categorization of PWR LERs between Jan 1
st
2010-2020
116

50.73a2ix Single Cause Prevention:
“(A) Any event or condition that as a result of a single cause could have prevented the fulfillment
of a safety function for two or more trains or channels in different systems that are needed to:
(1) Shut down the reactor and maintain it in a safe shutdown condition;
(2) Remove residual heat;
(3) Control the release of radioactive material; or
(4) Mitigate the consequences of an accident.
(B) Events covered in paragraph (a)(2)(ix)(A) of this section may include cases of procedural
error, equipment failure, and/or discovery of a design, analysis, fabrication, construction, and/or
procedural inadequacy. However, licensees are not required to report an event pursuant to
paragraph (a)(2)(ix)(A) of this section if the event results from:
(1) A shared dependency among trains or channels that is a natural or expected
consequence of the approved plant design; or
(2) Normal and expected wear or degradation.”

There are different approaches that can be implemented to study these events in more detail and
will depend on the ultimate objective and target. Some of these include:

• Independent Event Analysis:
This consists of studying each event individually and evaluating the contributing factors
and vulnerabilities that led to the event. This can be followed with further analysis to
measure the commonalities and understand patterns across the different individual events,
for example:
117

o How often is lack of training an issue?
o How often is an event based on an incorrect mental impression?
o How many events involve maintenance crew?

• Event Analysis at an Individual Reactor or Plant
This involves categorizing events further into groupings based on reactors or plants, to
understand and evaluate conditions at a specific location. This is useful to identify and
highlight vulnerabilities or deficiencies that are reactor or plant-specific. This is also useful
to identify which reactors or plants are doing fairly well in terms of mitigating the
occurrence of events, and learning from the strengths that other plants may have in terms
of operation, procedure, oversight etc.

• Contributing Factor Analysis:
This involves focusing the analysis on a certain contributing factor of interest, e.g. training,
skipped procedure, violation of procedure. One factor is studied in more detail to identify
its significance, frequency of occurrence, or type of resulting events etc. For example, if
training is the focus of the study, some questions that may be addressed include:
o How often is training a contributing factor in a Level 1 event? Level 2?
o Is training a more prevalent issue amongst a certain group of individuals in the
organization? e.g. supervisors

118

• Environment Analysis:
This involves studying conditions of the environment in relation to events. Some of this
analysis may include addressing questions such as:
o Is there a correlation between incidents and time of day? Are events more common
during the night shift?
o Is there a relationship between the maintenance of equipment and harsh weather?
e.g. in the hot summer months, are outdoor maintenance procedures more likely to
involve inadequate maintenance?

It is essential to first determine the ultimate objective of the analysis to be able to identify
what methodology is beneficial to undertake in order to obtain constructive results. The next
couple of chapters will present analysis to answer some of these questions and demonstrate the
methodology in doing so.

119

Chapter 12

Risk Analysis in Nuclear Reactors

As presented in Chapter 11, Licensee Event Reports will be used for the basis of this
analysis, specifically focusing on pressurized water reactor incidents between January 1
st
2010 and
January 1
st
2020. The methodology undertaken for risk analysis will depend on the question being
addressed and the goal of the study. Independent Event Analysis can be undertaken, similar to the
analysis presented in Chapter 10 for offshore oil platforms, when evaluating a single event and
understanding the contributing causes towards an individual event. When assessing the health of
an individual reactor or plant, a comprehensive study of all events occurring at an individual
reactor or plant can be undertaken. The next section will present example analysis for specific
regions or reactors.

Figure 12.1 U.S. NRC Regions Map (U.S. NRC, 2018b)
120

12.1 Event Analysis at a Specific Reactor, Plant, or Region
The U.S. NRC has 4 regions, with a regional office in each region overseeing the nuclear
facilities of the states under their jurisdiction, as presented in Figure 12.1. According to 2020 data
from the U.S. NRC website, the following facilities are located in each region (U.S. NRC, 2017):
Table 12.1 Reactors by Region
Region Pressurized Water
Reactors
Boiling Water
Reactors
Total Number of
Reactors
Region 1 11 10 21
Region 2 26 7 33
Region 3 12 11 23
Region 4 14 4 18
Total 63 32 95

Full details of plant names, license numbers, locations of plants and their respective
operators can be found in the Appendix. The number of total LERs and pressurized water reactor
LERs in each region between Jan 1
st
2010 – Jan 1
st
2020 are as follows:
Figure 12.2 Number of LERs by Region between Jan 1
st
2010-2020
121

In order to be able to effectively compare regions, this data will be normalized by the
number of reactors present in each region to obtain an average number of LERs per reactor in each
region, as presented in Figure 12.3.

Figure 12.3 Average Number of LERs per Reactor by Region between Jan 1
st
2010-2020

Now, we are able to visually and quantitatively compare regions more clearly. Focusing
on the Pressurized Water Reactor LERs, we note that Region IV has the highest average number
of LERs per PWR at 31.7 LERS. This is nearly 50% higher than Region II with the lowest average
at 21.6 LERs per PWR.

122

12.1.1 Event Analysis at a Specific Reactor, Plant, or Region by Severity Characterization

To understand the significance of these LERs, we categorize these LERs further into the
severity categorizations identified in Chapter 11. The top three severity categories are 50.73a2v,
50.73a2vii and 50.73a2ix. The LERs that fall into these categories are categorized in relation to
their regions and presented in Figure 12.4. Similarly, this data is normalized by number of reactors
in each region and presented in Figure 12.5. Again, Region IV exhibits the highest average number
of LERs per reactor in connection with the LERs that are considered most severe. Therefore, this
region is identified as the region that will be further analyzed in this section.

Figure 12.4 Number of PWR LERs in High Severity Categories

123

Figure 12.5 Average Number of PWR LERs in High Severity Categories per PWR

Focusing on Region IV, the LERs distribution of highest severities in Region IV are
presented in Figure 12.6. Roughly two-thirds (~62%) of the high severity LERs in Region IV are
classified under criteria 50.73a2v (B) and (D) that could have prevented the fulfillment of a safety
function or structures needed to remove residual heat or mitigate the consequences of an accident.
These events will be extracted for further analysis.

124

Figure 12.6 Distribution of PWR LERs in High Severity Categories for Region IV

12.1.2 Event Analysis at Specific Reactors in Region IV

To gain more insight on these events, we will evaluate the distribution of these events
amongst the different reactors in Region IV. Results are presented in Figure 12.7 and 12.8. We
note that evidently Fort Calhoun has been the biggest contributor to both criteria 50.73a2v (B) and
(D) and will necessitate further analysis. In fact, Fort Calhoun was taken offline and shut down
permanently in 2016 after being in operation since 1973 (Final Shutdown for Fort Calhoun, 2016).
These events occurred in the first six (2010-2016) out of ten years (2010-2020) of data being
analyzed, making it even more significant.
125

It is also important to note that Callaway, Diablo Canyon 1 and 2, Waterford and Wolf Creek are
also significant contributors to the two criteria analyzed, specifically 50.73a2v(d) and should also
be analyzed further.

Figure 12.7 Distribution of PWR LERs in Region IV Reactors for Criteria 50.73a2v(B)

126

Figure 12.8 Distribution of PWR LERs in Region IV Reactors for Criteria 50.73a2v(D)

12.1.3 Event Analysis at Fort Calhoun

To proceed with demonstration of this analysis, we will focus on the evaluation and
analysis of the Fort Calhoun pressurized water reactor in more detail. It is important to understand
the contributing factors and commonalities that led to the frequency of occurrence of these events.
127

Firstly, taking a closer look at criteria 50.73a2v(B), we will breakdown the events into operating
mode type.

Figure 12.9 Categorization of Fort Calhoun LERs 50.73a2v(B) by Operating Mode

We note that nearly ¾ of events (19 out of 26) under Criteria 50.73a2v(B) occurred during
Cold Shutdown, and therefore we will analyze this group of events further. Three of these events
occurred in 2011, six in 2o12, nine in 2013 and one in 2015, before the plant was eventually shut
down permanently in 2016.

The following table provides a summary of these events in Fort Calhoun, and the identified causes
that led to this event.
128

Table 12.2. Summary of 50.73a2v(B) events during Cold Shutdown in Fort Calhoun (LER Search, 2020)
LER
Number
Event
Date
Summary of Event Identified Causes
2852011008 06/07/2011 Failure of safety related 480 volt AC (V)
load center supply breaker resulted in fire
in the switchgear room.
• Odor present for three days not properly
communicated
• Overreliance on vendor knowledge
• Procedure lacking requirements
• Maintenance procedures inadequate

2852011010 06/07/2011 Fire in LER 2852011008 affecting one
train resulted in the opening of a circuit
breaker in an opposite train. Tripping of
both trains safety-related power lead to
loss of spent fuel pool coolin.
• Wire jumpers not properly configured.
• Inadequate testing and procedure
• Maintenance procedures inadequate
2852012001 02/10/2012 Inspection determined equipment required
to maintain safe shutdown not adequately
protected from flooding of 1014 feet Mean
Sea Level.
• Management did not effectively lead
recovery efforts for NRC design basis
inspection.
• Corrective actions not prioritized or
undertaken.
2852012005 02/21/2012 EDG pumps not tested as per requirements
of Technical Specifications. Procedure
change in the 1990s removed the required
testing.
• Lack of technical rigor in the 1990s
procedure change process.
• Insufficient documentation and verification
2852012015 09/16/2011 Number of components identified as not
qualified for the environments they are
located in, and should have been included
in the EEQ program. Non-compliant
components potentially impacted
operation of main steam isolation valves
and limited the ability to supply water to
reactant coolant system.
• Insufficient engineering rigor by preparer of
EEQ document.
• Insufficient verification and oversight on
document preparation.
2852012017 07/26/2012 Air operation valves discovered to have
nitrile based elastometers not fit for the
harsh environment. Failure of these valves
could prevent their safety function.
• EEQ program not fully implemented
adequately in the station.
• Insufficient engineering rigor and
documentation by preparer of EEQ
document.
• Insufficient verification and oversight on
EEQ program preparation.
2852012019 08/14/2012 Two out of six traveling screen sluice
gates indicated failure to fully close.
Engineers assured that the indication was
incorrect. 10 days later divers were sent to
confirm the closure of the gates, and found
that all six gates failed to fully close due to
debris and sediment deposited under the
gates.
• Process does not account for debris
obstructions.
• Insufficient preventive maintenance activity.
2852012021 01/29/2012 During extent of condition reporting, High
Pressure Safety Injection Valve was
determined to not be able to fulfill its
safety function. 2008 FlowScan analyses
indicated higher than acceptable valve
packing friction that the valve would not
have been able to fulfill after 24 hours.
• Failure to compare FlowScan analyses with
approved calculations.
• Poor turnover between engineers.
• Lack of AOV program procedure
129

2852013004 02/22/2013 Voltage swings experienced. • Removal of ground wire during 2011
refueling outage.
2852013006 03/02/2013 Mechanical seals identified in two safety
injection pumps and three containment
spray pumps made of Teflon that may not
perform as required under certain
conditions.
• Failure of Omaha Public Power District and
its consulting engineering firm to specify
compatible material for pump seals.
• Insufficient documentation
2852013008 04/11/2013 Three of seven safety-related General
Electric IVA relays failed seismic testing.
A wire used to support the control spring
in the relays was not installed. 45 GE IVA
relays were being used in the plant, 32
being safety-related. Twenty-seven were
found to be missing the wire, since
installation in 1978.
• Station determined the wires were missing
since installation in 1978.
• Insufficient maintenance, testing and
verification procedures.
2852013009 04/16/2013 Tornado missile vulnerabilities identified
during extent of condition review,
including roof openings, vent stack and fill
line, pump cable pull boxes and intake
structure removable hatches.
• Existed since licensing
• Insufficient review and modification
2852013010 05/03/2013 High Pressure Safety Injection pump flow
did not meet safety analysis report
descriptions.
• Pre-operational testing in 1972 were not
adequately translated into design documents.
• Engineers had limited understanding of HPSI
system
• Unclear or incomplete HPSI design basis
documents
2852013011 06/13/2013 Break in steam supply to auxiliary
feedwater turbine identified. Deficiency in
EEQ program identified.
• Station response to IE Bulletin 79-01B made
inaccurate assumptions with no supporting
documentation, resulting in non-compliance
of EEQ program.
• EEQ program procedures and activities
insufficient
2852013012 08/02/2013 Seismic analysis for intake structure crane
discovered to be inadequate and does not
evaluate the crane when in use.
• Insufficient engineering rigor
• Insufficient documentation and testing
procedures
2852013014 10/18/2012 Closure of steam driven valve found to
potentially result in pump damage.
• Equipment not maintained as safety-related
equipment.
• Design and modification processes
inadequate in assessing failure mode analysis
2852013016 11/05/2013 Several potential high energy line breaks
identified during extent of condition
review.
• Station did not fully implement EEQ
program to meet requirements.
• EEQ program not maintained adequately.
2852013017 10/31/2013 Containment spray pump design basis
documents did not adequately support
pump operation during runout conditions.
• Changes to the CS system and review of
design basis documents insufficient. No
evaluation of pump performance under
certain conditions. Pump curves not revised.
Calculation not updated.
• Inadequate engineering rigor and verification
2852015003 04/16/2015 Containment Spray piping has higher
stresses than previously analyzed.
• Thermal Expansion never considered in
design.
• No extensive design review done.
• Poor configuration control during
construction. Missing U-bolt and missing
kickers and support gaps not documented.
130

It is important to evaluate the events and assess if and what commonalities may exist
amongst different events that could be contributing to risk within a plant and the frequency of
events. In this case, we note the occurrence of organizational issues surrounding plant culture
including; inadequate maintenance, insufficient engineering rigor, inadequate documentation and
more. Figure 12.10 represents a summary of the different causes associated with the above-
summarized events.

Figure 12.10 Identified causes associated with 50.73a2v(B)
events during Cold Shutdown in Fort Calhoun
131

Subsequently, it is important to understand and evaluate what is leading to the deficiencies
or shortcomings identified. If not addressed and mitigated or corrected, these shortcomings can
continue to be a contributing factor in future events and their impact could lead to a growing ripple
effect of a much more serious consequence.

For example, if Insufficient Engineering Rigor were to be evaluated further, the following
causes (Competency, Oversight and Complacency) presented in Figure 12.11 may be found to
contribute to this shortcoming. Bayesian Belief Network Analysis can be useful at this stage, using
available quantitative data alongside expert qualitative data to understand the level of contribution
of each factor. For example, to run this analysis as an example case, the probability distribution
tables presented in Table 12.3 are used.

Figure 12.11 Contributing Causes towards Identified Event Cause
of Insufficient Engineering Rigor
132

Table 12.3. Probability Distribution Tables for Engineering Rigor Bayesian Belief Network Analysis

Competency
Category Probability
1. Strong 40%
2. Moderate 20%
3. Weak 40%

Oversight & Verification
Category Probability
1. Strong 30%
2. Moderate 50%
3. Weak 20%

Complacency
Category Probability
1. High 80%
2. Low 20%

Engineering Rigor
Competency Strong Moderate Weak
Oversight Strong Moderate Weak Strong Moderate Weak Strong Moderate Weak
Complacency H L H L H L H L H L H L H L H L H L
1. Sufficient (%)
70 85 65 70 60 68 65 70 60 65 50 55 62 68 55 58 45 50
2. Insufficient (%)
30 15 35 30 40 32 35 30 40 35 50 45 38 32 45 42 55 50

These probability distribution tables will be used for this example analysis, however it is
important to note that any qualitative data at this stage needs to be provided by trusted experts in
the field, through survey collection tools, interviews or similar. As quantitative data becomes
available and accessible and/or qualitative data changes, these probability distribution tables can
be updated accordingly.
133

Figure 12.12 Bayesian Belief Network Example for Engineering Rigor

Running this model as presented above, in Figure 12.12, provides useful insight into
understanding the relationships between contributing factors, and the ability to evaluate and predict
the impact of improving certain variables.

For example, if the plant or facility ensures a strong level of competency assigned to an
engineering task that involves design modifications, calculations and analysis, as well as a strong
verification and oversight process, while a high level of complacency is still prevalent in the
organization, we can set this as our evidence in the Bayesian Belief Network and evaluate what
effect this is projected to have on Engineering Rigor, as follows:

134

Figure 12.13 Example of Evidence of Strong Competency and Oversight with High Complacency

Moreover, the network can be easily modified to include other potential contributors or to
modify relationships. For example, if it is determined by experts that a relationship exists between
Oversight & Verification, and Complacency, (strong oversight linked to reducing levels of
complacency and vice versa) this relationship can be introduced, and the network updated as
follows:

Figure 12.14 Introduction of Additional Relationship between Oversight and Complacency

135

The new network can then be evaluated to understand how this relationship positively or
negatively improves the probability of sufficient Engineering Rigor, as demonstrated in Figure
12.15.

In this case, Oversight & Verification now has a more significant effect on Engineering
Rigor due to its direct relationship with Engineering Rigor and its secondary relationship with
Complacency. It is important to clearly understand and assign these relationships through the use
of experts in the field to effectively capture the various relationships that exist within a plant, an
organization or across people.

Figure 12.15 Updated Probability Distribution with Additional Relationship between Oversight and Complacency

136

12.1.4 Identification of Areas for Improvement

Once this analysis is undertaken to understand the various relationships that lead to
contributing factors in an event, the next crucial step is understanding and evaluating what steps a
plant or organization can take to mitigate these effects. For example, if in this case, the analyst or
researcher has decided to focus on the issue of Complacency amongst their operators, this should
be extracted and evaluated in more detail, irrespective of the event or incident(s) being studied, to
understand how the organization as a whole may be contributing to a higher level of complacency
than is desired.

Figure 12.16 depicts an example expanding Complacency to include the following
contributing factors:

• Successful cutting of corners: This refers to prior shortcuts taken at work and observing
that nothing went wrong, therefore leading to more comfort and confidence in taking
shortcuts.
• Lack of Oversight: This includes procedures in place to verify certain tasks have been
completed adequately.
• Co-worker influence: This refers to the attitude of co-workers, e.g. if co-workers are
confident in cutting corners, skipping tasks, performing tasks inadequately, this could
negatively lead to other co-workers feeling comfortable in doing the same.
• Absence of Crisis: This refers to the absence of a large-scale disaster or serious incident,
leading workers to feel a lesser sense of urgency.
137

• Lack of Incentive: This refers to lack of recognition of workers who perform well and
follow safety guidelines etc.
• Fatigue
• Task Repetition: This refers to repetitive work that breeds boredom and less focused
awareness.
• Management Commitment to Safety: This refers to management’s demonstration of their
commitment to safety and the importance of workplace safety.

Figure 12.16 Evaluation of Complacency and its Contributing Factors

138

The organization can then evaluate the current status of these various factors and assess
where improvements can be made. For example, cross-training may be introduced to combat high
task repetition and introduce variety to the job. It is important to introduce changes that are
measurable to be able to assess the effectiveness of these changes. It is also useful when evaluating
the system through a bottoms-up approach, working backwards through the analyses to understand
the impact a change has on the system as a whole.

A similar methodology can be followed to evaluate other contributing factors at the same
plant, at different plants or different regions of interest. This is beneficial when seeking to identify
and evaluate plant performance or regional performance, and identify key plants that may be
performing poorly, or plants that may be performing significantly better than other plants and
understand the compounding factors.

In the Gulf, where several surrounding countries are embarking on introducing nuclear
power to the region, and the shared resource of water is critical to preserve, it is important to be
able to assess how different plants in the region are performing through a shared criterion of
identification.

Furthermore, it is essential that the different host countries can learn from each other, both
from any weaknesses that are identified, but also from strengths that are identified, so that the
countries can mitigate any weaknesses collectively, as a weakness or vulnerability in one plant, is
a vulnerability for the entire region.

139

12.2 Event Analysis of a specific Contributing Factor (Human Error)

Another approach for data analysis of past events, involves focusing on a specific
contributing factor to identify its significance, frequency of occurrence or other questions of
interest pertaining to a specific contributing factor. To demonstrate this evaluation, we will focus
on Licensee Event Reports that had a determination of Human Error as a main contributor to the
incident reported. For Licensee Event Reports for Pressurized Water Reactors between Jan 1
st

2010-2020, twenty-four reports were identified to list Human Error as a main contributing cause
to the reported event, summarized as follows (LER Search Results, 2020):

Table 12.4 Summary of Human Error Licensee Event Reports
LER Number
Plant
Name
Event Date Title
2442018002 Ginna 10/26/2018 Loss of Offsite Power to Vital Bus due to Human Error Causes
Automatic Actuation of Emergency Diesel Generator "A"
2472016005 Indian
Point 2
03/26/2016 Technical Specification (TS) Prohibited Condition due to a
Surveillance Requirement Never Performed for Testing the
Trip of the Main Boiler Feedwater Pumps
2502012004 Turkey
Point 3
09/06/2012 Condition Prohibited by Technical Specifications due to
Instrument Process Line Reversal During Replacement
2692013002 Oconee 1 06/26/2013 LPI and RBS Trains Inoperable When 1LP-21 Was Closed Due
To Human Error
2692017001 Oconee 1,
2 and 3
06/16/2017 Loss of Both Keowee Hydroelectric Units due to Human Error
2752011005 Diablo
Canyon 1
05/26/2011 Emergency Diesel Generator Actuations Upon Loss of 230 kV
Startup Due to Electrical Maintenance Testing
2752011006 Diablo
Canyon 1,
and 2
08/29/2011 Loss of Control Room Envelope Due to the Work Control Shift
Foreman Incorrectly Authorizing Removal of a Blank Flange
2752011007 Diablo
Canyon 1
and 2
09/12/2011 Inadequate Control Room Envelope Testing Due to
Inadequately-Documented In-leakage Test Data
2752011008 Diablo
Canyon 1
and 2
11/03/2011 Control Room Ventilation System Design Vulnerability
2752013001 Diablo
Canyon 1
and 2
01/03/2013 Noncompliance with TS 3.4.12, "Low Temperature
Overpressure Protection System" due to Human Error
140

2802010003 Surry 1 06/08/2010 Loss of Vital Bus due to Human Error Results in Automatic
Reactor Trip
2872017001 Oconee 3 07/24/2017 Unit 3 Reactor Protection System Actuation - Reactor Trip due
to Turbine Trip from Generator Lockout
3232013003 Diablo
Canyon 2
03/18/2013 Technical Specification 3.6.3 and 3.0.4.a Not Met due to
Human Error
3232019001 Diablo
Canyon 2
11/30/2019 Containment Spray Inoperable in Mode 4
3382010005 North
Anna 1
12/12/2010 Unanalyzed Scaffolding Renders Charging Pump Inoperable
due to Human Error
3642017005 Farley 2 11/13/2017 Power Range Nuclear Instrument Inoperable due to Poor
Connection of High Voltage Cable Connector
3892011002 St. Lucie 2 06/06/2011 Unplanned Automatic Reactor Trip During Reactor Protection
System Testing
3892013002 St. Lucie 2 06/03/2013 Failure to Invoke Technical Specification Action Statement for
Failed Containment
Isolation Valve
3892017003 St. Lucie 2 10/25/2017 Improper System Realignment Resulted in Loss of Steam
Driven Auxiliary Feedwater Pump Flow Indication
3952011001 Summer 1 05/03/2011 Failure to Maintain One Train of Safe Shutdown Systems in
Accordance with Appendix R Section III.G.a/III.G.3
4462011004 Comanche
Peak 2
07/11/2011 Human Error Resulting in Inoperability of All Safety Injection
Accumulators
4992015001 South
Texas 2
03/04/2015 Technical Specification Action Statement Time Exceeded due
to Turbine-Driven Auxiliary Feedwater Pump Test Failure Not
Recognized
5282016003 Palo Verde
1
09/21/2016 Inoperable Containment Isolation Valve SGA-UV-1134 due to
Failure to Close During Testing
5302015002 Palo Verde
3
05/01/2015 Condition Prohibited by Technical Specification 3.0.4 due to an
Inoperable Atmospheric Dump Valve (ADV)

This can be further categorized by Region or specific plants, as presented in the following
figures, if the goal is to identify a geographical pattern or local vulnerability:

141

Figure 12.17 Human Error LERs by Region

Figure 12.18 Human Error LERs by Plant
142

We note that Diablo Canyon 1 and 2 have higher instances of Human Error determinations
and should be evaluated further. There is some overlap in the events as some events impacted both
Diablo Canyon 1 and 2 simultaneously.

The events at Diablo Canyon determined to be Human Error related are as follows:

Table 12.5 Summary of Human Error Licensee Event Reports for Diablo Canyon
LER Number
Plant
Name
Event Date Title
2752011005 Diablo
Canyon 1
05/26/2011 Emergency Diesel Generator Actuations Upon Loss of 230 kV
Startup Due to Electrical Maintenance Testing
2752011006 Diablo
Canyon 1,
and 2
08/29/2011 Loss of Control Room Envelope Due to the Work Control Shift
Foreman Incorrectly Authorizing Removal of a Blank Flange
2752011007 Diablo
Canyon 1
and 2
09/12/2011 Inadequate Control Room Envelope Testing Due to
Inadequately-Documented In-leakage Test Data
2752011008 Diablo
Canyon 1
and 2
11/03/2011 Control Room Ventilation System Design Vulnerability
2752013001 Diablo
Canyon 1
and 2
01/03/2013 Noncompliance with TS 3.4.12, "Low Temperature
Overpressure Protection System" due to Human Error
3232013003 Diablo
Canyon 2
03/18/2013 Technical Specification 3.6.3 and 3.0.4.a Not Met due to
Human Error
3232019001 Diablo
Canyon 2
11/30/2019 Containment Spray Inoperable in Mode 4

12.2.1 Expert Evaluation of Human Error Licensee Event Reports

It is important to understand what lead to the Human Error. Human Error, especially when
recurring, can be a symptom of other deficiencies in the workplace such as poor safety systems in
place, unclear procedure, insufficient training, low worker morale etc.

143

To analyze these events further, we surveyed nuclear experts in the field through interviews
and surveys to capture their expertise in evaluating the factors that may have led to the human
error. These experts include former shift supervisors, nuclear engineers, regulatory professionals,
managers and nuclear safety culture experts. Some of these questions included:

• What organizational issues could have been contributors to this event? (Example: unclear
guidance, etc.)
• What design issues could have been contributors to this event? (Example: components in
close proximity leading to inadvertent actuation of switch)
• What questions would you pose to further evaluate the conditions of this event? (Example:
Operator’s working conditions? Long hours? Pressure to get task done? etc.)
• Did anything in the Licensee Event Report indicate a strength or weakness in a
commitment to safety, at the individual or organizational level? (safety culture)
• Would you consider Human Error to be the primary cause of this event?
• Would you consider the corrective action sufficient to prevent a similar event?

In addition to the questions posed with regards to review of the Licensee Event Reports, the
surveyed experts were also presented with two models (Human Performance Model and Open
Systems Model) that were developed under the guidance of Nuclear Experts #1 and #2, as a means
to capture as much relevant information as possible and as a guideline to minimize bias that experts
may have through their different experiences in different roles, reactors and organizations. It is
important to introduce a guideline or standard procedure when collecting qualitative data to allow
for a structured method to collect and analyze this data and quantify it accordingly.
144

Figure 12.19 Human Performance Improvement Model

The Human Performance Improvement Model focuses on improving performance in the
workplace through analysis of performance which can be achieved through different approaches,
including; observations, performance indicators and assessments. When deficiencies or
shortcomings are observed, the model moves to analyzing the cause of these shortcomings e.g.
unclear guidance, fatigue, design deficiencies. After evaluation and understanding the causes, the
best approach to rectify these shortcomings is selected. Selection involves evaluating solutions and
their implications, in terms of cost, feasibility, ease of implementation etc. These solutions need
to be reviewed by management or decision-making personnel and should be measurable so that
results can be tracked. After implementation, further evaluation is necessary to evaluate actual
145

performance and determine whether desired performance is achieved. Whilst a gap is still present,
further analysis is necessary following the same loop to further minimize the gap or deficiencies
in performance.

Figure 12.20 Open Systems Model

The Open Systems Model deals with the interactions that happen both within the
organization in addition to externally. It takes into consideration the values of the organization and
how that translates into the leadership culture and how together that propagates within the culture
of the environment into the systems and structures implemented, the design of the work
environment, the experience and morale of the workforce and operations. External Factors and
146

their effects are important to consider as well, as these factors such as regulatory factors, natural
conditions such as weather and financial factors can impact the organization as a whole, as well as
the organization having external implications.

Following the collection of experts’ insights into these Human Error events and the internal
and external factors that may have contributed to these events, the next stage involves analyzing
the collected qualitative data and quantifying the results to be able to assign measures to the data,
and as a basis for tracking and assessing improvement.

Licensee Event Report: 275-2011-005
The following causes were identified by experts to contribute to this event:

Figure 12.21 Contributing Causes to Event Report 275-2011-005
147

It is critical to understand what factors facilitated human error to occur. The same event
occurred on two consecutive days with personnel attaching test equipment to the incorrect terminal
associated with the other unit. Nuclear Expert #3 highlighted that there was a concern with regards
to the “safety culture attribute” and “not fully addressing the previous event” that had occurred
while Nuclear Expert #5 stated, “If a procedure is important enough not to go wrong, it should
have been set up to ensure it did not fail”.

The experts highlighted several areas where improvements could be made to prevent such a
re-occurrence. These recommendations include:

• Clear labeling of the electrical panels to distinguish Unit 1 terminals from Unit 2.
• Relocation of electrical equipment so Unit 1 and Unit 2 terminals are not co-located.
• Training of personnel towards effective use of human performance tools.
• Revising written work procedures – the same event happened two days in a row with
personnel attaching test equipment to the incorrect terminal associated with the other unit.

Licensee Event Report: 275-2011-006

In this case, Nuclear Expert #5 highlighted that “too many layers of defense were violated
to simply conclude this is a human error cause”. At least four different groups were involved and
the issue went un-identified. It is unclear if the procedure in place actually guides the maintenance
work, and therefore whether a change in procedure (as was concluded to undertake), will have
much effect on preventing a further occurrence of an event with similar underlying contributors.
148

A more systemic organizational issue could be present in connection with the safety culture
of the organization in this instance, with the symptom being all the different groups that were part
of the process and neither one recognizing that an incorrect activity had taken place.

The following areas of concern for Licensee Event Report 275-2011-006 were highlighted by the
surveyed experts:

Figure 12.21 Contributing Causes to Event Report 275-2011-006

149

Licensee Event Report: 275-2011-007

Figure 12.22 Contributing Causes to Event Report 275-2011-007

In this event, an NRC Senior Resident Inspector questioned the 2005 CRE in-leakage
testing, leading to PG&E discovering that inadequate testing had been taking place since 2005.
They noted that the bases of SR 3.7.10.5 was unclear and rather than reaching out to NRC to
receive clarification, they reached out to industry experts, and misinterpreted the procedure.

The experts reviewing this LER determined that lack of oversight and verification through
peer checks and supervision, in addition to complacency and lack of knowledge surrounding the
complicated requirements, led to the inadequacies in the procedure.
150

This signifies a safety culture where safety systems are not prioritized, work processes did
not focus on safety, and a questioning attitude all being challenged.

Licensee Event Report: 275-2011-008

This event is similar to the previous event where interpretation of SR 3.7.10.5 was
incorrect, and PG&E consulted industry experts instead of requesting clarification from NRC.

Figure 12.23 Contributing Causes to Event Report 275-2011-008

As Nuclear Expert #3 stated, a “lack of questioning attitude” was present that led this event
to remain undiscovered since 1991, and only discovered after “interaction with the NRC”.

151

Licensee Event Report: 275-2013-001

Figure 12.24 Contributing Causes to Event Report 275-2013-001

Similar to the prior two events, a misinterpretation of procedure occurred and was only
discovered after NRC questioning. This highlights a pattern of lack of proper verification and
rigorous attention to detail as well as complacency in the workplace. As Nuclear Expert #4
highlighted in their reviews that a concern in these events is having a “narrow focus on the
proximate event and completely ignoring the broader management and organizational issues
implied”.

152

Licensee Event Report: 323-2013-003

Figure 12.25 Contributing Causes to Event Report 323-2013-003

This event is another event linked to the failure to use human performance tools. Nuclear
Expert #3 highlights “lack of effective leadership” and “personal accountability”. This concern is
not unique to Diablo Canyon. Through evaluation of the human error reports at other plants,
instances of lack of proper use of human performance tools were identified. For example, Nuclear
Expert #6 highlighted the same issue in LER 244-2018-002 at Ginna Nuclear Power Plant,
questioning whether management has “explained and reinforced the use of human error prevention
tools”. These are important trends to analyze further across different plants.
153

Licensee Event Report: 323-2019-001

Figure 12.25 Contributing Causes to Event Report 323-2019-001

Through review of this LER, experts highlighted similar recurring issues, including “time
pressure”, “personal accountability” and better “work processes”. After collating experts’ reviews
of the licensee event reports we can analyze this data to assess patterns and commonalities amongst
these events. We note that organizational issues are a common occurrence including inadequate
review processes, unclear work instructions and weak administrative controls in place. These
organizational issues trickle down the organization and breed individual shortcomings such as
complacency, confusion of procedures and missed actions. The symptom is eventually an incident
that is classified as a “human error”.
154

Figure 12.26 Collation of Human Error Licensee Event Report Results

155

Results of the data collation can be further used to quantify probabilities of various
contributing factors, given a Human Error has occurred in the plant. The following presents an
example of this representation as a result of experts’ review:

Figure 12.27 Example Bayesian Belief Network through Expert Review
of Human Factor Events in diablo Canyon

It is beneficial to implement external expert review to understand deficiencies and the
further questions that need to be addressed, from a viewpoint that is not affected by the internal
organizational culture e.g. complacency, inadequate response, lack of priority of safety issues.

In this case, a significant outlier was present in Diablo Canyon, warranting further analysis.
Outliers may not always exist, but it is useful to determine if there are specific plants or regions
that have a highlighted deficiency by analyzing specific contributing factors against the different
plants. Evaluation does not need to be limited to a specific plant but can assess multiple plants and
common deficiencies amongst plants to work towards a collective improvement across plants.
156

This can then be used as a basis for decision analysis by management and stakeholders, to
evaluate and introduce barriers against identified risks and vulnerabilities.

12.3 Implications of Event Analysis

It is imperative that the safety incidents occurring at nuclear power plants are further
studied and evaluated in detail in future research, to better understand deficiencies that may exist
within a plant or organization. It is critical to identify these vulnerabilities and address how to
mitigate them, with consistent tracking and evaluation of improvement. These vulnerabilities may
not have previously led to a critical event, but as these vulnerabilities are exacerbated by time,
public policies that do not properly prioritize risk mitigation, and closer geographic proximity to
other vulnerabilities, the risk and barriers to safety become more pronounced.

This analysis presents a methodology to analyze past events and identify vulnerabilities,
whether present at a specific plant or as a commonality that exists among several plants. This is
not limited to the example analysis provided, but can be implemented similarly to analyze different
contributing causes, identifying deficiencies within a certain group of personnel, design
deficiencies in specific areas of the plant, etc.

While analysis was performed on data from U.S. nuclear reactors due to the lack of data
availability in the Persian/Arabian Gulf, analysis can be similarly framed for the Gulf should data
become available. For example, analysis performed on U.S. nuclear reactors by region (Region 1,
Region 2, etc.) can be reconstructed by country (Country A, Country B, etc.).
157

In addition, with regards to the Gulf and the unique concentration and presence of three
large scale industries (oil, nuclear, desalination), there are additional areas of consideration that
are important to evaluate, such as proximity and shared connections that may be prevalent across
industries. The next section will introduce methodology to combine risk analysis of nuclear power
plants with offshore oil platforms and desalination plants to account for the interdependencies that
exist within these infrastructures.

158

Chapter 13

Multi-Industry Risk Analysis Framework

The nuclear, oil and desalination industries in the Gulf all heavily depend on the Gulf water
for their operations, in addition to depending on each other for their corresponding energy and
water supplies. It is crucial that the interdependencies that exist between these three industries is
studied and a framework established to evaluate the risk associated with these interdependencies.

In previous chapters, risk analysis was performed for the oil and nuclear industry
individually, since it is first important to ensure that a methodology exists for independent
assessment of each industry, before setting up a framework for their interdependencies. The
desalination industry events were not reviewed in detail, as mentioned previously, due to the nature
of incidents at desalination industries being of a less sudden and catastrophic nature in comparison
with the oil and nuclear industries. It is still important to consider the desalination industry because
incidents occurring at an oil or nuclear facility can directly affect desalination operations.

13.1 Interdependency Framework for Nuclear, Oil and Desalination Industry

Figure 13.1 depicts the eight identified categories that could lead to a potential multi-industry
event:

• Natural Disaster; refers to an external event caused by natural processes such as
earthquakes, hurricanes, sandstorms etc. This can also include pandemics such as COVID-
19.
159

• Government and Regulation; refers to the external policies and laws set by governments
or regulatory bodies that impacts how an organization operates e.g. pollution prevention
practices.
• Proximity; refers to the shared locality of industries that allows for an event in one industry
to impact another industry, e.g. an oil tanker spill impacting a nearby desalination plant
intake.
• Shared Connection; a link or component shared between more than one industry e.g.
power line
• Identical Component; refers to components used in more than one industry in a similar
manner, and therefore susceptible to the same types of failures e.g. emergency diesel
generators
• Human Influence; decisions or actions a person undertakes affecting more than one
industry, e.g. maintenance crew serving more than one industry.
• Organizational Influence; a similar organizational culture in more than one industry e.g.
complacency, or lack of commitment to safety.
• Economic Event; an event affecting the economy of a country or region leading to shared
consequences e.g. job losses, or inflation.

160

Figure 13.1 Multi-Industry Dependency Categories

For this next stage, Economic Events, Natural Disasters and Government and Regulation
categories will all be classified under External Events (EE). Shared Connections and Identical
Components will both be considered under Shared/Similar Component (SC). Human Influence and
Organizational Influence will be classified under Common Cause (CC) events.

161

Figure 13.2 presents a model framework to illustrate how these categories can interact and
be evaluated across the three industries; nuclear, oil and desalination. An External Event (EE), for
example, a sandstorm, can trigger events occurring in more than one industry such as Event A in
the nuclear industry, Event B in the oil industry and Event C in the desalination industry. These
events could be similar such as loss of offsite power in more than one industry, or different, such
as a sandstorm triggering a tanker collision in the oil industry, and the subsequent leak
contaminating the water intake of a nearby desalination plant. The conditional probabilities of
these events occurring is presented by the green rectangles denoting, for example, for the nuclear
industry, the probability that Event A occurs given External Event (EE) has occurred, etc.

The events can be analyzed in more detail through Fault Trees and Bayesian Belief
Networks, as presented in previous chapters, to understand and quantify all the contributing
factors, as well as determine predictions and perform vulnerability analysis. It is critical to
understand the different external events that could pose a risk to multiple industries and understand
how they impact these industries and where the vulnerabilities may be, before such an event
occurs. It is also beneficial for resource planning and event management responses, to effectively
and efficiently respond to incidents and distribute resources.

Shared/Similar Component (SC) denotes shared connections and identical components
across multiple industries. This can be across all three industries, as presented in the center of the
diagram denoted by SC, or across two industries, denoted by SCA, SCB and SCC, and will impact
the same component or connection in each industry, for example, component “E” in all three
industries, as depicted above.
162

Figure 13.2 Schematic of Multi-Industry Interdependency Analysis

163

Common Cause (CC) refers to a common cause that leads to an event or failure that is not
necessarily directly linked to an identical component or connection, but rather human and
organizational influences that are similar and contribute to an event, such as human error, incorrect
installation, complacency etc. These are not linked to the same piece of equipment or function, but
share a contributing cause, e.g. incorrect installation of one piece of equipment in a nuclear reactor,
and incorrect installation of another piece of equipment in an offshore oil plant, both resulting in
an incident. For example, CCC represents a common cause failure triggering event C in a
desalination plant, and event F in a nuclear reactor. It is important to assess and evaluate what
commonalities exist amongst industries, such as common vendors, common maintenance groups
etc, and share relevant data to capture any vulnerabilities identified in one industry, as it could
present a vulnerability in another industry too.

Proximity (Pr) needs to be taken into account when evaluating risk and interdependencies
amongst industries, as a shared locality or environment can increase the potential avenues for a
multi-industry event. For example, event D occurring in a nuclear reactor, may trigger event R in
a desalination plant when proximity is taken into account, denoted as PrC .

164

13.2 Modeling of Multi-Industry Interdependencies

In order to set up a framework for analysis, the following steps should be taken:

1. Identify an event (external or internal), shared component or connection for analysis.
This consists of determining a critical event or component that has the potential of
impacting multiple industries, to be evaluated in more detail.

2. Determine a locality or region of interest.
This involves identifying a cluster of plants belonging to different industries for analysis
and is selected based on the goal of the study. This could initially be one plant from each
industry in closest proximity, and then developed further to include other plants, or it could
be linked to the event of interest or other factors. For example, if seismic activity is the
event of interest being analyzed, plants located nearest to active faults may be selected.

3. Develop logic models for the system.
This step consists of evaluating the systems in each industry and their relationships and
constructing logic models such as fault trees and Bayesian belief networks for each
industry.

4. Quantify logic models.
This consists of evaluating past data of incidents and events to assign probabilities of sub-
events and failures. For items or contributing factors with limited data or inability to
165

quantify, expert judgment should be introduced in the form of qualitative information that
can be translated into quantitative data.

5. Assess commonalities and integrate the system.
This involves evaluating the commonalities across the three industries and connecting the
industries through the categories established in the analysis above, e.g. proximity, shared
connections etc.

6. Run the model and quantify results.
This step consists of running the model of the integrated system to develop results.

7. Analyze results.
This involves identifying the vulnerabilities in the system, running sensitivity analyses, and
evaluating the system as a whole.

8. Evaluate Risk Management and Mitigation Practices
Based on the result analysis, the final stage involves making use of the data and identified
vulnerabilities to understand and evaluate how to reduce the risk in the system, and how to
develop effective and efficient risk management practices and responses to the evaluated
incident.

166

The associated risk elements to manage risk are presented in Figure 13.3. Laws and
Regulations are a constraint that have a direct impact on what an organization can and cannot do,
and are set in place by governments, and regulatory authorities. Communication surrounding risk
needs to happen at a stakeholder level to identify the goals, objectives, and preferences of
stakeholders. Stakeholders can differ depending on the condition being studied. For example,
issues pertaining to water contamination, may include stakeholders from local authorities or the
ministry of environment, while disaster preparedness may include the general public as
stakeholders. It is important to address who these stakeholders are that may be influenced by
decisions or may influence decisions. Industry experts need to be consulted as well, and while they
may fall under stakeholders, they are identified separately under risk communication, as there
should always be industry experts included in risk communication and decision-making. Cross-
industry collaboration and data sharing is a critical area when dealing with multiple industries that
operate independently of each other. Because these industries share the same body of water and
can have severe consequences on each other, there must be communication across industries as
well as sharing of data to collectively understand the risks and vulnerabilities the industries impose
on each other.

This communication leads to introduction of policies within organizations and should also
lead to identification of criteria for risk acceptance, e.g. a criteria for acceptable levels of risk
associated with frequency of releases (small release frequency, large release frequency) in nuclear
power plants.
167

Figure 13.3 Schematic of Multi-Industry Risk Elements
168

Risk Assessment and analysis can then take place once a risk criterion has been set, to be
able to assess risk against this criterion using the example methodology presented above. This can
constitute analysis of external events or internal events. Frequencies, probabilities, consequences
and vulnerabilities should be evaluated, and cross-industry vulnerabilities should be identified. It
is important to consider at this stage the potential multi-industry factors such as proximity, shared
connections and identical components.

This can then translate into management of risk and identified vulnerabilities, by
introducing risk barriers, and safeguards to mitigate the frequency of events or the consequences
of such potential event. Measure that are implemented to control and reduce risk need to be
measured and monitored to evaluate and analyze effectiveness. Communication needs to take place
as well in conjunction with risk mitigation and planning with stakeholders and experts.

Strategies for risk control include eliminating the risk (e.g. changing the design of a system
process), or reducing the frequency of occurrence of an event, (e.g. adding additional safeguards),
or mitigating the consequences of an event (e.g. introducing automatic sprinklers to minimize
consequence of a fire).

Finally, it is important to ensure that the systems and risk methodologies in place are easy
to update when a change or modification is made, or as more data becomes available.

169

Chapter 14
A Regional Framework for Multi-Industry
Cooperation in the Gulf

The interdependencies across the nuclear, oil and desalination industries in the Gulf are not
limited to these three industries, but also extend across the countries that operate these industries.
Cross-industry and cross-country collaboration are both crucial elements in the creation of an
effective coordinated framework for inter-operability.

Because the various plants operating in the Gulf are owned by different organizations and
countries, it is important to have a linked and unified governing board that regulates regional
policies and practices and facilitates sharing of data and information.

An example of what this network may look like is presented in Figure 14.1. The top level
consists of a Regional Regulator; an independent governing board in charge of establishing
regional policies and regulating and monitoring practices. This Regional Regulator communicates
with a second layer that consists of Industry-Specific Regulators, that set industry-specific
regulations in line with the regional regulator’s policies and communicates with the countries or
regulatory boards of the countries to implement certain guidelines and practices in their industries.

These regulators also communicate with each other to decide on best practices taking into
account the interdependencies amongst these industries, as well as creating regional response
170

strategies to effectively respond to a regional incident and dissipate information effectively and
efficiently to all countries.

The final layer involves the individual countries in the Gulf implementing the policies and
laws within their own industries and regulatory bodies while communicating and sharing
information between their respective industries. The countries also have direct chains of
communication with each other to allow for ease of collaboration and sharing of data and
information between each other.

Ideally, the industry-specific regulators manage the collection and reporting of certain
criteria of incidents based on guidelines developed by the regulators. This allows for the creation
of a database to monitor and regulate practices, as well as facilitate access to data for the
surrounding countries. The existence of this independent entity also helps mitigate the potential
risk of political conflict that could otherwise result in a breakdown of inter-regional
communication and regulatory oversight. This data can then be used for analysis, evaluating
vulnerabilities, monitoring performance and introducing risk control measures on a continuous
basis.

Having a standard that all countries follow is important to be able to effectively manage
incidents, evaluate data and collaborate effectively.
171

Figure 14.1 Regional Collaboration and Cooperation
among surrounding Gulf countries and multi-industries
172

With regional collaboration in place, the risk analysis framework for the three industries
(nuclear, oil, desalination) can be expanded further to include cross-country analysis. A conceptual
example is presented in the below figure for three countries, X, Y and Z. Similar methodology can
be applied for cross-country analysis as presented in Chapter 13 for cross-industry analysis.

Figure 14.2 Multi-Country and Multi-Industry Risk Analysis Framework
173

For example, a hypothetical external event EEy can be evaluated to understand its effects
on surrounding countries and their infrastructure. This event could be an earthquake, a spill,
contamination etc., that has the potential to impact multiple countries’ industries.

Proximity is an important factor to take into consideration at this stage of analysis. For
example, an event occurring in Country Z could trigger an event in Country Y given a certain
proximity, denoted as Prx in the above diagram. This multi-country analysis is especially useful
when evaluating and implementing response strategies for incidents that can affect multiple
industries in different countries.

14.1 Risk Prevention and Recovery

Potential causes of multi-industry and multi-country incidents need to be evaluated
quantitatively and qualitatively at a regional level in order to introduce prevention strategies to
reduce the frequency or probability of an incident occurring from a specific cause.

Sometimes risks can be completely eliminated but this is not always the case, and therefore
strategies for reducing the frequency or minimizing the probability may be the only option. This
means that in addition to preventive strategies, there also needs to be mitigation strategies
implemented to mitigate the impact and consequences an event has when it occurs. The
consequences can include the number of countries or industries impacted, or more specific
consequences such as the extent of environmental damage, the cost of cleanup efforts etc. Re-
174

active barriers in place for mitigation can include factors such as onsite emergency recovery efforts
e.g. dedicated fire brigade that can respond immediately once an undesired event occurs.

Regional regulators should have safety indicators and measures in place that provide
insight into potential areas where safety improvements are needed, to prevent the occurrence of an
undesired event. These indicators can be either leading indicators, which are measures that indicate
safety prior to the occurrence of a future event or lagging indicators which are measures based on
data after the occurrence of undesired events.

Figure 14.3 Bow-tie diagram for multi-industry event
175

Examples of leading indicators that can be implemented are:

• Safety reviews and site audits performed by an independent external body
• Surveying and polling of employees
• Reporting systems for near misses
• Evaluating frequency of safety trainings
• Regulatory inspections

While lagging indicators are measures after an incident has occurred, it is still important to evaluate
and measure post-event data, such as:

• Lost-time injuries: an injury that prevents an employee from working for at least one shift
• Lost workdays: number of workdays missed due to workplace injuries
• Frequencies of injuries

The frequency of lost-time injuries can be measured as follows:

𝐿𝑇𝐼𝐹𝑅 =
OU.UV [UXW W=QS =OrPT=SX (stuX) =O TSvUTW=Ow vST=U^ ∙ xyy,yyy
WUWZ[ zUPTX {UT|S^ =O TSvUTW=Ow vST=U^
(14.1)

The value 200,000 represents 100 workers working 2,000 hours per year, and therefore the
frequency rate is the number of lost time injuries per 100 workers.
176

Similarly, Lost Workday Rate can be calculated as follows:

𝐿𝑊𝑅 =
OU.UV [UXW {UT|^Z~X ∙ xyy,yyy
WUWZ[ OU.UV zUPTX {UT|S^
(14.2)

It is important to introduce standard indicators that countries and industries can use to
measure their safety performance, and for regulators to also have a systematic approach of
reviewing safety in the various industries and countries and perform additional review where
needed when safety indicators are outside the acceptable range. This is also beneficial for setting
clear goals or targets for industries and countries to continuously work towards achieving.

177

Chapter 15
Conclusion and Recommendations

This chapter will provide a summary of the research undertaken and discuss areas for future
work, such as more rigorous analysis when future data become readily available and accessible, as
well as recommendations. The objective of this research work is to provide a foundation for multi-
industry risk analysis, specifically in the Gulf, focusing on the nuclear, oil and desalination
industries, but with general applicability to any region with multiple industries.

In a 2020 editorial in The Economist, low probability high-impact events such as the
current ongoing COVID-19 pandemic were highlighted along with how government preparedness
can significantly impact the outcomes of such large-scale events. This is especially applicable and
relevant to our research work, as we aim to introduce a foundational framework for government
preparedness in the case of an incident in the Gulf (The Economist, 2020).
178

15.1 Summary of Work

The unique combination and concentration of the three major industries in the Gulf
(nuclear, oil and desalination) was studied from a risk analysis perspective to provide a foundation
for risk analysis of the interdependencies of the three industries. These three industries work
independently of each other while the nature of their operations in the Gulf creates a complex set
of interdependencies, with a large-scale incident occurring in one industry having potential
catastrophic effects in another industry. The extent of these three industries’ operations, their
significance and their history were explored in Chapters 2, 3, 4 and 5.

Our work expands Schroer S. and Modarres M. (2013)’s work in considering risk in a
multi-unit nuclear power plant to examining risk in a multi-industry network. Events or
contributing areas for multi-industry events were categorized into eight areas; natural disaster,
government and regulation, identical component, human influence, shared connection, economic
event, physical proximity and organizational influences. Each of these areas are covered in more
detail in Chapter 6.

Chapters 7 and 8 explore methodologies for analysis and categorizing data further in terms
of severity and consequences. The methodologies chosen included fault tree analysis, and
Bayesian belief networks, as these were identified as tools that are relatively simple, user-friendly,
easy to update, and allow for dissimilar information to be used e.g. both qualitative and quantitative
data. Risk analysis does not need to be limited to these methodologies, but these were identified
as a good starting point for the foundation of our multi-industry analyses.
179

Chapters 9 to 12 include applications of these methodologies to present examples of how
data can be analyzed in the oil and nuclear industry. Oil industry data from the Bureau of Safety
and Environmental Assessment (BSEE) in the US was used and Licensee Event Report from the
Nuclear Regulatory Commission (NRC) in the US, due to the lack of accessibility to data from
nuclear and oil plants in the Gulf.

Finally, Chapters 13 and 14 presents a methodology to integrate analysis of the three
industries and assess how these industries impact each other as well as the surrounding countries.
A framework is also developed to provide a suggested regional network for multi-industry
cooperation in the Gulf, to allow for the dissipation of information across countries and allow for
a unified standard of laws, policies, reporting, monitoring and review of all industries across
countries, as well as coordinated regional response strategies in the case of an incident.

15.2 Recommendations for Further Research

Throughout our work, there were certain limitations that prevented us from exploring
certain avenues further, that may be of interest to pursue in the future.

15.2.1 Data Limitation

Our analysis was performed on data of offshore oil platforms and nuclear reactors in the
USA. This limitation does not limit the applicability of the analysis as systems, technologies and
180

humans are susceptible to failure, irrespective of location or region, however future work should
include the implementation and evaluation of data from the Gulf offshore oil platforms and nuclear
reactors as data becomes accessible to capture incidents that may be region specific e.g. a specific
vendor etc. Continuous updating of analysis is also important for consistent improvement and
implementation of risk reduction strategies.

15.2.2 Climate Change Modeling

While we touched upon the importance and significance of climate change in the region,
in Chapter 5, this is an avenue that can be explored further.

Jeremy Pal’s (2016) publication presented temperature forecasts in the Gulf and identified that
these countries will reach critical points of human survivability within the next century, following
a business-as-usual (RCP8.5) projection.

It is important to note that this paper focused solely on greenhouse gas warming, therefore
not taking into account the potential warming that nuclear power plants may cause in the Gulf
through their once-through cooling methods of discharging warmer water back into the Gulf.

This is an important area of research to understand the impact of nuclear power plants on
the already warming Gulf. In conjunction with this, another area for analysis is the efficiencies of
these nuclear power plants, as the warmer the water in the Gulf gets, the larger the volume of water
required for the cooling of nuclear reactors, making them less efficient.
181

15.2.3 Expert Insight and Judgment

One of the methods to combat lack of quantitative data is to introduce expert judgment and
subjective reasoning to understand some of the relationships in the workplace and level of
contributing factors to incidents or certain event occurrences.

This area can be expanded further to include future work to determine and evaluate how to
obtain the most useful and accurate data in relation to subjective reasoning.
Analysis such as determining who to ask, how to ask, the most effective questions, the best tools,
and how to best translate this data into quantitative data can be undertaken.

Ideally, a standard methodology is set for industries to follow that is effective in each
industry and introduces a unified methodology to allow for ease of data compilation and evaluation
across industries.

15.2.4 Extended Risk Analysis

In this research work, we focused on fault trees and Bayesian belief networks for
integrated risk analysis as we recognized the importance of the introduction of techniques that are
not too complex, to allow industries and regulators to apply these methodologies with not too much
training required. Evaluation of other more complex risk analysis techniques can be evaluated
along with the creation of a framework for their integration across industries and countries.

182

15.2.5 Human Error Evaluation

Human Error is one of the more difficult areas to quantify, as there is commonly more than
one contributing cause that leads to human error and can be difficult to measure. Examples include
unclear work guidance, poor design of workstation, incorrect mental impression etc.

There is room to evaluate this further with a specific focus in the Gulf to determine
methodologies to assess these errors, their significance, and quantify them. This is an important
area to evaluate as humans, in many cases, can be the final safeguard in place between an undesired
event and its consequences.

Many of these industries in the Gulf are multi-national companies, with a large number of
different nationalities, languages and cultures present in the workplace. For example, UAE’s
national oil company, ADNOC employs over 11,000 people of 50 different nationalities according
to their website (ADNOC Distribution, 2020).

It may be interesting to study how and if this high distribution of nationalities amongst the
workplace, influences areas such as communication, safety training, implementation of procedures
etc.

183

15.3 Conclusion

This research work addresses the importance and significance of developing a systematic
framework linking the three industries (nuclear, oil, desalination) as well as the surrounding
countries in the Gulf, with applicability in other regions and interdependent industries.

The COVID-19 pandemic was a poignant reminder that large scale events and emergencies
know no borders, and effective response strategies warrant unity and camaraderie. In response to
the pandemic, Professor Joseph Nye, who served as Assistant Secretary of Defense for
International Security Affairs, Chair of the National Intelligence Council, and Deputy Under
Secretary of State for Security Assistance, Science and Technology, made the following
observation, which is a fitting closing statement summarizing the importance of enhanced
cooperation (Nye, 2020):

184

Bibliography:

Al-Ghalayini, B. (25
th
November 2018). Desalination in Saudi Arabia. Arab News. Retrieved
from https://www.arabnews.com/node/1410576

Almashabi, D. (14
th
October 2015). Saudis to Build Biggest Water Storage Project in Riyadh.
Bloomberg. Retrieved from http://www.bloomberg.com/news/articles/2014-10-14/saudis-to-
build-biggest-water-storage-project-in-riyadh

AlNasrallah, E. (2018) Kuwait, Country Nuclear Power Profiles. IAEA. Retrieved from
https://www-pub.iaea.org/MTCD/Publications/PDF/cnpp2018/countryprofiles/Kuwait

Alosairi Y. and Pokavanich T., (2017), Residence and transport time scales associated with Shatt
Al Arab discharges under various hydrological conditions estimated using a numerical
model, Marine Pollution Bulletin, 118(1), 85-92.

Aquastat. (2008). Islamic Republic of Iran. Food and Agriculture Organization of the United
Nations. Retrieved from http://www.fao.org/3/ca0339en/CA0339EN.pdf

Asaba, B. (2018). Rosatom in Talks to Build Nuclear Plant in Kuwait. Utilities-Middle East.
Retrieved from https://www.utilities-me.com/article-5236-rosatom-in-talks-to-build-nuclear-
plant-in-kuwait
Bachellerie, I. J. (2012). Renewable energy in the GCC countries. Geneva, Switzerland: Gulf
Research Center. Retrieved from http://library.fes.de/pdf-files/bueros/amman/09008.pdf
Bellini, E. (9
th
January 2020). Saudi Arabia Launches 1.2GW Solar Tender. PV Magazine.
Retrieved from https://www.pv-magazine.com/2020/01/09/saudi-arabia-launches-1-2-gw-
pv-tender/

Beveridge, G. (2009) Lee & Ko, Pillsbury bring nuclear power to the UAE. Legal Business
Online. Retrieved from https://www.legalbusinessonline.com/news/lee-ko-pillsbury-bring-
nuclear-power-uae/58146

Borunda, A. (20
th
April 2020). We still don’t know the full impacts of the BP oil spill, 10 years
later. National Geographic. Retrieved from
https://www.nationalgeographic.com/science/2020/04/bp-oil-spill-still-dont-know-effects-
decade-later/

Brownlee, J. (2020). A Gentle Introduction to Bayesian Belief Networks. Machine Learning
Mastery. Retrieved from https://machinelearningmastery.com/introduction-to-bayesian-
belief-networks/

BSEE (Bureau of Safety and Environmental Enforcement. BSEE) (2020) Offshore Incident
Statistics. Retrieved from https://www.bsee.gov/stats-facts/offshore-incident-statistics

185

BSEE Panel (2015). Investigation of Loss of Well Control and Fire South Timbalier Area Block
220, Well No. A-3. OCS Report. Retrieved from
https://www.bsee.gov/sites/bsee.gov/files/panel-investigation/incident-and-investigations/st-
220-panel-report9-8-2015.pdf

BTS, Bureau of Transportation Statistics. (2019). Petroleum Oil Spills Impacting Navigable U.S.
Waterways. United States Department of Transportation. Retrieved from
https://www.bts.gov/content/petroleum-oil-spills-impacting-navigable-us-waters

Chen, G., Yang, Z. & Sun, J. (2010). Applying Bayesian Networks in Nuclear Power Plant
Safety Analysis. Procedia Engineering. 7. 81-87. 10.1016/j.proeng.2010.11.012.

Committee on lessons learned from Fukushima Nuclear accident for improving safety of U.S.
Nuclear Plants. (2014). Nuclear and Radiation Studies Board; Division on Earth and Life
Studies; National Research Council. Washington (DC): National Academies Press (US);
2014 Oct 29. https://www.ncbi.nlm.nih.gov/books/NBK253923/

Construction on Saudi’s Desal plant in Al Khobar 55% complete. (2019, August 5). Construction
Week. Retrieved from https://www.constructionweekonline.com/257612-construction-on-
swccs-desal-plant-in-saudi-arabias-al-khobar-55-complete

Danzig, R. (2018). Technology Roulette: Managing Loss of Control as Many Militaries Pursue
Technological Superiority. Center for a New American Security Report.

Dudley, D. (26
th
July 2020). World’s Largest Solar Power Plant Moves Forward in Abu Dhabi
With Contract Award. Forbes. Retrieved from
https://www.forbes.com/sites/dominicdudley/2020/07/26/worlds-largest-solar-power-
plant/#35f0f5d2b65f

EIA. (2019). The Strait of Hormuz is the world’s most important oil chokepoint. Today in
Energy. U.S Energy Information Administration, June 20. Retrieved
from https://www.eia.gov/todayinenergy/detail.php?id=39932

Energy Information Administration. (2020). What Countries are the Top Producers and
Consumers of Oil? Retrieved from https://www.eia.gov/tools/faqs

Evans, G. (2020). Persian Gulf. Encyclopedia Britannica. Retrieved from
https://www.britannica.com/place/Persian-Gulf

Final Shutdown for Fort Calhoun (2016). World Nuclear News. Retrived from
https://www.world-nuclear-news.org/Articles/Final-shutdown-for-Fort-Calhoun

GCC (Gulf Cooperation Council) (2014). Desalination in the GCC – The History, The Present
and The Future. The Cooperation Council for Arab States in the Gulf (GCC) General
Secretariat, pp. 27-29.

186

Groth K, Wang C and Mosleh A (2010), Hybrid causal methodology and software platform for
probabilistic risk assessment and safety monitoring of socio-technical systems. Reliability
Engineering & System Safety. Vol. 95(12), pp. 1276-1285.

Hofste, R. (2019). 17 Countries, Home to One-Quarter of the World’s Population, Face
Extremely High Water Stress. World Research Institute. Retrieved from
https://www.wri.org/blog/2019/08/17-countries-home-one-quarter-world-population-face-
extremely-high-water-stress

Hokstad, I. B. Utne, & J. Vatn (Eds.), Risk and Interdependencies in Critical Infrastructures – A
Guideline for Analysis (Vol. 1, pp. 30-40). Springer.

Imran, M., Chryssanthopoulos, M. & Sathananthan, S. (2015). Bridge condition modelling and
prediction using dynamic Bayesian belief networks, Structure and Infrastructure
Engineering, 11:1, 38-50, DOI: 10.1080/15732479.2013.879319

IRENA. (2015). Renewable Energy Prospects: United Arab Emirates. REmap 2030 analysis.
Retrieved from https://www.irena.org/-
/media/Files/IRENA/Agency/Publication/2015/IRENA_REmap_UAE_report_2015.ashx

KAHRAMAA awards the Strategic Mega Reservoirs Project. (2015, March 15). Qatar General
Electricity and Water Cooperation. Retrieved from
https://www.km.qa/MediaCenter/Pages/NewsDetails.aspx?ItemID=98

Liu, Z.& Mrad, N. (2013). Validation of Strain Gauges for Structural Health Monitoring With
Bayesian Belief Networks. Sensors Journal, IEEE. 13. 400-407.
10.1109/JSEN.2012.2217954.

Marafiq. (2020). Potable Water. Retrieved from https://www.marafiq.com.sa/en/80-jubail---
potable-water/1/51

McAuley, A. (20
th
January 2016). UAE eyes new clean energy target by 2030. The National.
Retrieved from https://www.thenational.ae/business/uae-eyes-new-clean-energy-generation-
target-by-2030-1.208057

MEED. (2019). US confirms nuclear energy talks with Saudi Arabia. Power Technology.
Retrieved from https://www.power-technology.com/comment/us-confirms-nuclear-energy-
talks-with-saudi-arabia/

Meshkati, N., Tabibzadeh, M., Farshid, A., Rahimi, M., & Alhanaee, G. (2016). People-
Technology-Ecosystem Integration: A Framework to Ensure Regional Interoperability for
Safety, Sustainability, and Resilience of Interdependent Energy, Water, and Seafood
Sources in the (Persian) Gulf. Human Factors, 58(1), 43–
57. https://doi.org/10.1177/0018720815623143

187

Minimal Cut Set Analysis (2000). Guidelines for Chemical Process Quantitative Risk Analysis,
Second Edition. Center for Chemical Process Safety. American Institute of Chemical
Engineers. pp.661-669

Mogielnicki, R. (2020) Water Worries: The Future of Desalination in UAE. The Arab Gulf States
Institute in Washington. Retrieved from https://agsiw.org/wp-
content/uploads/2020/03/Mogielnicki_Desalination_ONLINE.pdf
Mohaghegh, Z., Kazemi, R., & Mosleh, A. (2009). Incorporating organizational factors into
Probabilistic Risk Assessment (PRA) of complex socio-technical systems: A hybrid
technique formalization. Reliability Engineering and System Safety, 94(5), 1000-
1018. https://doi.org/10.1016/j.ress.2008.11.006

Mueller, M. (2020). Nuclear Power is the Most Reliable Source and It’s Not Even Close. Office
of Nuclear Energy. Retrieved from https://www.energy.gov/ne/articles/nuclear-power-most-
reliable-energy-source-and-its-not-even-close

Nadimi, F. (2020, April). Iran’s evolving approach to asymmetric naval warfare: strategy and
capabilities in the Persian Gulf. Policy Focus 164. The Washington Institute for Near East
Policy.

NOAA, National Oceanic and Atmospheric Administration. (2020). Oil Spills. U.S. Department
of Commerce. Retrieved from https://www.noaa.gov/education/resource-collections/ocean-
coasts/oil-spills

Nye, J. (2020) Global Trends and Foreign Policy. Harvard Kennedy School. Retrieved from
https://www.hks.harvard.edu/faculty-research/policy-topics/public-leadership-
management/how-covid-19-has-changed-public-
policy?utm_source=SilverpopMailing&utm_medium=email&utm_campaign=Daily%20Gaz
ette%2020200629%20(1)#international_affairs

OBG, Oxford Business Group (2020). New Solar Power Projects in Bahrain Add to the
Country’s Energy Mix. Retrieved from
https://oxfordbusinessgroup.com/analysis/sustainable-options-new-solar-power-projects-
will-add-energy-mix

Oceana. (2018). Impacts of Offshore Drilling. Retrieved from https://usa.oceana.org/impacts-
offshore-drilling

O’Dea A. and Flin R. (2001). Site Managers and Safety Leadership in the Offshore Oil and Gas
Industry. Safety Science, 37(1), 39–57. https://doi.org/10.1016/S0925-7535(00)00049-7

Odimabo, O. Odouza, C. & Suresh, S. (2017). Methodology for Project Risk Assessment of
Building Cosntruction projects using Bayesian Belief Networks. International Journal of
Construction Engineering and Management 2017, 6(6): 221-234 DOI:
10.5923/j.ijcem.20170606.01

188

Ollero, A., Hussain, S., Varma,S., ; Peszko, G., & Al-Naber, H. (2019). Economic
Diversification for a Sustainable and Resilient GCC (English). Gulf Economic Update; no. 5
Washington, D.C. World Bank Group.
http://documents.worldbank.org/curated/en/886531574883246643/Economic-
Diversification-for-a-Sustainable-and-Resilient-GCC

OnTheWorldMap (2020). Retrieved from http://ontheworldmap.com/oceans-and-seas/persian-
gulf.html

OPEC. (2019). Share of World Crude Oil Reserves. Retrieved from
https://www.opec.org/opec_web/en/data_graphs/330.htm

Qvist, S. (2019) Curtailment of nuclear power output during extreme heatwaves: The European
Case. Energy for Humanity. Retrieved from https://energyforhumanity.org/wp-
content/uploads/2019/08/Qvist-Nuclear-and-Heat-Waves-August-2019-FINAL_.pdf

Pal, J. and Elfatih, E. (2016) Future Temperature in Southeast Asia projected to exceed a threshold
for human adaptability, Nature Climate Change, Vol 6, 2016

Parkes K. (2007). Working hours in the offshore petroleum industry, presented at Petroleum
Stavanger Authority Conference, Stavanger, Norway, 2007.

Parnell, J. (21
st
January 2020). Total and Marubeni to Build 8MW Solar Plant in Qatar Ahead of
World Cup. Greentech Media. Retrieved from
https://www.greentechmedia.com/articles/read/totals-qatar-deal-nudges-middle-east-
bifacial-pipeline-towards-2gw

Policy of the UAE on Evaluation and Potential Development of Peaceful Nuclear Energy.
(2008). ENEC. Retrieved from https://www.enec.gov.ae/doc/uae-peaceful-nuclear-energy-
policy-5722278a2952f.pdf

Rajavi, Y. (2013, December 7). Water Desalination in the Middle East. Submitted as coursework
for PH240 Stanford University. Retrieved from
http://large.stanford.edu/courses/2013/ph240/rajavi2/

Ramana, PV. (2020). Fault Tree Analysis. Six Sigma Study Guide. Retrieved from
https://sixsigmastudyguide.com/fault-tree-analysis/

Ramseur, J. (2017). Oil Spills: Background and Governance. Congressional Research Service.
Retrieved from https://fas.org/sgp/crs/misc/RL33705.pdf

Reason J. (2000). Human error: models and management. BMJ (Clinical research
ed.), 320(7237), 768–770. https://doi.org/10.1136/bmj.320.7237.768

189

Saudi Arabia’s SWPC seeks bid for Jubail desalination plant. (2020). Smart Water Magazine.
Retrieved from https://smartwatermagazine.com/news/smart-water-magazine/saudi-arabia-
swpc-seeks-bid-jubail-desalination-plant

Schneider, M. (2019). The World Nuclear Industry Status Report 2019. A Mycle Schneider
Consulting Project.

Schroer, S. (2013). An Event Classification Schema For Considering Site Risk in a Multi-Unit
Nuclear Power Plant Probabilistic Risk Assessment. Reliability Engineering & System
Safety, vol. 117, 40-51. https://doi.org/10.1016/j.ress.2013.03.005

Shurafa, S. (2019, June 12). Kuwait and Saudi Arabia record highest temperature on earth.
World Gulf. Retrieved from https://gulfnews.com/world/gulf/kuwait-and-saudi-arabia-
record-highest-temperature-on-earth-1.1560325581417

Sorkhabi, R. (2010). Why so much oil in the Middle East? GeoExPro, 7, 20-26.

Statista. (2019). Number of Offshore Rigs Worldwide as of January 2018. Fossil Fuels. Retrieved
from https://www.statista.com/statistics/279100/number-of-offshore-rigs-worldwide-by-
region/

Statista (2020) World Natural Gas Production in 2018. Fossil Fuels. Retrieved from
https://www.statista.com/statistics/264101/world-natural-gas-production-by-country/

SWCC (Saline Water Conversion Cooperation) (2020). Desalination Plants. Retrieved from
https://www.swcc.gov.sa/english/Projects/DesalinationPlants/Pages/default.aspx

S&P Global Platts (2020). Strait of Hormuz shipping rates climb on oil tanker threat from Iran.
Retrieved from https://www.spglobal.com/platts/en/market-insight

The Economist Intelligence Unit. (2018). Rising Salinity from Desalination. Retrieved from
https://www.woi.economist.com/content/uploads/2019/01/Charting-the-course-for-ocean-
sustainability-in-the-Indian-Ocean-Rim_Chapter-5-Rising-water-salinity.pdf

The Economist (2020, June 25) Politicians ignore far-out risks: they need to up their game.
Retrieved from https://www.economist.com/leaders/2020/06/25/politicians-ignore-far-out-
risks-they-need-to-up-their-game

Tinmannsvik, R.K. (2011). The Deepwater Horizon Accident: Causes, lessons learned and
recommendations for the Norwegian petroleum activity. SINTEF. Retrieved from
https://www.sintef.no/globalassets/upload/konsern/media/deepwater-horizon---sintef---
executive-summary.pdf

USGS. (2020). Desalination. Retrieved from https://www.usgs.gov/special-topic/water-science-
school/science/desalination
190

U.S. NRC. (2017). Facilities by NRC Region or State. Retrieved from https://www.nrc.gov/info-
finder/region-state/

U.S. NRC. (2018a). Backgrounder on Three Mile Island Accident. Retrieved from
https://www.nrc.gov/reading-rm/doc-collections/fact-sheets/3mile-isle.html

U.S. NRC. (2018b). NRC Regions. Retrieved from https://www.nrc.gov/images/reading-rm/doc-
collections/maps/nrc-regions.png

U.S. NRC. (2020a). ROP Framework. Retrieved from
https://www.nrc.gov/reactors/operating/oversight/rop-description.html

U.S. NRC (2020b). Licensee Event Report System. Retrieved from https://www.nrc.gov/reading-
rm/doc-collections/cfr/part050/part050-0073.html

Veolia Water to build desalination plant at Sadara Petrochemical Complex in Jubail City. (2013).
Veolia Water. Retreived from
https://www.veolia.com/sites/g/files/dvc2491/files/document/2014/02/pr_20130702.pdf

Wang, YF, Liu, ZM, Jiang, JC, Khan, F and Wang, J (2019) Blowout fire probability prediction
of offshore drilling platform based on system dynamics. Journal of Loss Prevention in the
Process Industries, 62. ISSN 0950-4230

What are the different methods used for seawater desalination? (2019, March 5). Planete
Energies. Retrieved from https://www.planete-energies.com/en/medias/close/what-are-
different-methods-used-seawater-desalination

Why ADNOC Distribution (2020) ADNOC. Retrieved from
https://careers.adnocdistribution.ae/en/working-with-us/why-adnoc-distribution

World Nuclear Association. (2018). Nuclear Power in UAE. Retrieved from https://www.world-
nuclear.org/information-library/country-profiles/countries-t-z/united-arab-emirates.aspx

World Nuclear Association. (2019). Nuclear Power in Saudi Arabia. Retrieved from
https://www.world-nuclear.org/information-library/country-profiles/countries-o-s/saudi-
arabia.aspx

World Nuclear Association. (2020a). Nuclear Power in Iran. Retrieved from https://www.world-
nuclear.org/information-library/country-profiles/countries-g-n/iran.aspx

World Nuclear Association. (2020b). Emerging Nuclear Energy Countries. Retrieved from
https://www.world-nuclear.org/information-library/country-profiles/others/emerging-
nuclear-energy-countries.aspx

191

World’s largest man-made desalinated water reserve completed in Abu Dhabi. (2018).
WaterWorld. Retrieved from
https://www.waterworld.com/international/desalination/article/16203290/worlds-largest-
manmade-desalinated-water-reserve-completed-in-abu-dhabi

Zerrouki, H., Smadi, H. (2017). Bayesian Belief Network Used in the Chemical and Process
Industry: A Review and Application. J Fail. Anal. and Preven. 17, 159–165.
https://doi.org/10.1007/s11668-016-0231-x

Zidane, Y. (2015). Categorization of organizational factors and their impact on project
performance. 29
th
World Congress International Project Management Association
(IPMA),162-69.

192

Appendix A. Desalination Plants in the Persian/Arabian Gulf

(GCC, 2014; SWCC, 2020; Mogielnicki, 2020; Marafiq, 2020; Veolia Water, 2013)

Kingdom of Saudi Arabia
Plant Capacity (m3/day) Technology Commissioning Year
Al Jubail 1 118,447 MSF 1981
Al Jubail 2 815,185 MSF 1982
Al Jubail 3 78,182 RO 2001
Marafiq (Al
Jubail)
800,000 MED 2010
Sadara (Al Jubail) 178,000 RO 2015
Al Jubail SWRO-
4
100,000 RO 2018
Al Khobar 2 200,700 MSF 1983
Al Khobar 3 252,000 MSF 2000
Al Khafji 2 19,682 MSF 1985
Ras Al Khair 1,025,000 MSF + RO 2016

United Arab Emirates
Plant Capacity (m3/day) Technology Commissioning Year
Abu Dhabi Steam
Station
68,000 MSF 1977
Ajman 45,460 RO 2011
Ajman 41,000 MED 2000
Ajman 14,500 RO 1994
Al Hamariah 90,900 RO 2014
Al Layyah 289,000 MSF + MED 1981
Al Mirfa 177,000 MSF 1996
Al Mirfa 240,000 RO 2017
Al-Rahmaniya 22,700 RO 2009
Al Saja’a 25,000 RO 2000
Al Zawra 1 27,000 RO 2008
Al Zawra 2 13,600 RO 2012
Al Zawra 3 32,000 RO 2012
Fujairah F1 464,000 RO + MSF 2005
Fujairah F2 600,000 MED + RO 2010
Ghalilah 13,700 RO 2005
Ghalilah 68,200 RO 2015
Jebel Ali D 160,000 MSF 1979
Jebel Ali E 114,000 MSF 1989
Jebel Ali G 273,000 MSF 1993
Jebel Ali G 114,000 RO 2007
Jebel Ali K 273,000 MSF 2000
Jebel Ali L 568,000 MSF 2005
Jebel Ali M 636,000 MSF 2011
Jabel Dhanna 18,000 MED + TVC 1996
193

Kalba 33,000 MED + RO 1995
KFK 23,000 RO 2009
Layyah 288,000 MSF + MED + RO 2007
Nakheel 73,000 MED 1998

Shuweihat 1 459,000 MSF 2004
Shuweihat 2 459,000 MSF 2011
Taweelah A1 386,000 MSF + MED 2001
Taweelah A2 232,000 MSF 1995
Taweelah B1 318,000 MSF 1995
Taweelah B2 104,000 MSF 2000
Taweelah 314,000 MSF 2008
UAQ-A 11,400 RO 1985
UAQ-B 11,400 RO 2008
Umm Al Nar 659,000 MSF + MED 1979
Umm Al Nar 659,000 MSF + MED 2007

Kingdom of Bahrain
Plant Capacity (m3/day) Technology Commissioning Year
Sitra 114000 MSF 1975-1985
Ras Abu Jarjur 73000 RO 1984
Hidd 409000 MSF+MED 2000-2005
Alba 31818 MED 2004
Al Dur 1 218000 RO 2011

Kuwait
Plant Capacity (m3/day) Technology Commissioning Year
Shuaiba South 164,000 MSF 1971-1975
Doha East 191,000 MSF 1978-1979
Doha West 502,000 MSF 1983-1985
Al Showaikh 225,000 MSF+RO 1982-2011
Shuaiba North 270,000 MSF 2009-2010
Az Zour North 405,000 MED 2016
Az Zour South 136,000 RO 2016
Sabiya 455,000 MSF 2006-2007

Qatar
Plant Capacity (m3/day) Technology Commissioning Year
Ras Abu Fontas A 250,000 MSF 1983 &1994
Ras Abu Fontas B 150,000 MSF 1997-1998
Ras Laffan 182,000 MSF 2003-2004
Ras Laffan B 273,000 MSF 2006-2008
Ras Abu Fontas
A1
205,000 MSF 2010
Ras Abu Fontas
A2
136,000 MSF 2008
194

Ras Abu Fontas
A3
164,000 RO 2017
Ras Qertas 286,000 MED 2010-2011
Dukhan 9,000 MED 1997

Sultanate of Oman
Plant Capacity (m3/day) Technology Commissioning Year
Barka 4 280,100 RO 2018
Al Ghubra 191,000 RO 2016
Sohar 250,000 RO 2018
Surr 131,000 RO 2009/16

Iran
Plant Capacity (m3/day) Technology Commissioning Year
Bandar Abbas I 400,000 RO -
Asalouyeh 10,000 RO 2004
Asalouyeh –
South Pars
120,000 RO
Asalouyeh –
South Pars Gas
16,000 MED + TVC
Hormozgan 164,000 RO
Zahedan 20,000 RO 2010
Bushehr 200,000 RO 2014

Under construction/consideration:
(“Saudi Arabia’s SWPC seeks bid”, 2020; “Construction on Saudi’s Desal”, 2019)

Country Location Capacity
(m3/day)
Technology
Oman Khasab 16,000 -
Oman Al Ghubrah Expansion 300,000 -
Bahrain Al Dur 2 218,000 RO
Kuwait Doha 1 275,000 RO
UAE

Taweelah 757,000 RO
Hassyan 545,000 RO
UAQ 681,900 RO
RAK 100,000 RO
Saudi Arabia Al Khobar 1 210,000 RO
Al Khobar 2 600,000 RO
Al Jubail 3A 600,000 RO
Al Jubail 3B 570,000 RO
Al-Khafji 600,000 SWRO
Iran

Bushehr 200,000
Bandar Abbas 1,000,000 RO

195

Appendix B. U.S. Nuclear Power Plants

(U.S. NRC, 2017)
Region I
Plant Name Reactor Type Location Owner/Operator
Beaver Valley 1 PWR 17 miles W of McCandless, PA FirstEnergy Nuclear Operating Co.
Beaver Valley 2 PWR 17 miles W of McCandless, PA FirstEnergy Nuclear Operating Co.
Calvert Cliffs 1 PWR 40 miles S of Annapolis, MD Constellation Energy
Calvert Cliffs 2 PWR 40 miles S of Annapolis, MD Constellation Energy
FitzPatrick BWR 6 miles NE of Oswego, NY Exelon FitzPatrick, LLC / Exelon
Generation Company LLC
Ginna PWR 20 miles NE of Rochester, NY Constellation Energy
Hope Creek 1 BWR 18 miles SE of Wilmington, DE PSEG Nuclear, LLC
Indian Point 3 PWR 24 miles N of New York City, NY Energy Nuclear Operations, Inc.
Limerick 1 BWR 21 miles NW of Philadelphia, PA Exelon Generation Co., LLC
Limerick 2 BWR 21 miles NW of Philadelphia, PA Exelon Generation Co., LLC
Millstone 2 PWR 3.2 miles WSW of New London,
CT
Dominion Generation
Millstone 3 PWR 3.2 miles WSW of New London,
CT
Dominion Generation
Nine Mile Point 1 BWR 6 miles NE of Oswego, NY Constellation Energy
Nine Mile Point 2 BWR 6 miles NE of Oswego, NY Constellation Energy
Peach Bottom 2 BWR 17.9 miles S of Lancaster, PA Exelon Generation Co., LLC
Peach Bottom 3 BWR 17.9 miles S of Lancaster, PA Exelon Generation Co., LLC
Salem 1 PWR 18 miles S of Wilmington, DE PSEG Nuclear, LLC
Salem 2 PWR 18 miles S of Wilmington, DE PSEG Nuclear, LLC
Seabrook 1 PWR 13 miles S of Portsmouth, NH NextEra Energy Seabrook, LLC
Susquehanna 1 BWR 70 miles NE of Harrisburg, PA Susquehanna Nuclear, LLC
Susquehanna 2 BWR 70 miles NE of Harrisburg, PA Susquehanna Nuclear, LLC

Region II
Plant Name Reactor Type Location Owner/Operator
Browns Ferry 1 BWR 32 miles W of Huntsville, AL Tennessee Valley Authority
Browns Ferry 2 BWR 32 miles W of Huntsville, AL Tennessee Valley Authority
Browns Ferry 3 BWR 32 miles W of Huntsville, AL Tennessee Valley Authority
Brunswick 1
BWR 30 miles S of Wilmington, NC Duke Energy Progress, LLC
Brunswick 2 BWR 30 miles S of Wilmington, NC Duke Energy Progress, LLC
Catawba 1 PWR 18 miles S of Charlotte, NC Duke Energy Carolinas, LLC
Catawba 2
PWR 18 miles S of Charlotte, NC Duke Energy Carolinas, LLC
Farley 1 PWR 18 miles E of Dothan, AL Southern Nuclear Operating Co.
Farley 2 PWR 18 miles E of Dothan, AL Southern Nuclear Operating Co.
Hatch 1 BWR 20 miles S of Vidalia, GA Southern Nuclear Operating Co., Inc.
Hatch 2 BWR 20 miles S of Vidalia, GA Southern Nuclear Operating Co., Inc.
McGuire 1 PWR 17 miles N of Charlotte, NC Duke Energy Carolinas, LLC
McGuire 2
PWR 17 miles N of Charlotte, NC Duke Energy Carolinas, LLC
North Anna 1 PWR 40 miles NW of Richmond, VA Dominion Generation
North Anna 2 PWR 40 miles NW of Richmond, VA Dominion Generation
Oconee 1 PWR 30 miles W of Greenville, SC Duke Energy Carolinas, LLC
Oconee 2
PWR 30 miles W of Greenville, SC Duke Energy Carolinas, LLC
196

Oconee 3 PWR 30 miles W of Greenville, SC Duke Energy Carolinas, LLC
Robinson 2
PWR 26 miles NW of Florence, SC Duke Energy Progress, LLC
Saint Lucie 1
PWR 10 miles SE of Ft. Pierce, FL Florida Power & Light Co.
Saint Lucie 2 PWR 10 miles SE of Ft. Pierce, FL Florida Power & Light Co.
Sequoyah 1
PWR
16 miles NE of
Chattanooga, TN Tennessee Valley Authority
Sequoyah 2
PWR
16 miles NE of
Chattanooga, TN Tennessee Valley Authority
Shearon Harris 1 PWR 20 miles SW of Raleigh, NC Duke Energy Progress, LLC
Summer
PWR 26 miles NW of Columbia, SC South Carolina Electric & Gas Co.
Surry 1
PWR
17 miles NW of Newport
News, VA Dominion Generation
Surry 2
PWR
17 miles NW of Newport
News, VA Dominion Generation
Turkey Point 3
PWR 20 miles S of Miami, FL Florida Power & Light Co.
Turkey Point 4 PWR 20 miles S of Miami, FL Florida Power & Light Co.
Vogtle 1 PWR 26 miles SE of Augusta, GA Southern Nuclear Operating Co.
Vogtle 2
PWR 26 miles SE of Augusta, GA Southern Nuclear Operating Co.
Watts Bar 1 PWR 60 miles SW of Knoxville, TN Tennessee Valley Authority
Watts Bar 2
PWR 60 miles SW of Knoxville, TN Tennessee Valley Authority

Region III
Plant Name Reactor Type Location Owner/Operator
Braidwood 1
PWR 20 miles SSW of Joliet, IL Exelon Generation Co., LLC
Braidwood 2
PWR 20 miles SSW of Joliet, IL Exelon Generation Co., LLC
Byron 1 PWR 17 miles SW of Rockford, IL Exelon Generation Co., LLC
Byron 2 PWR 17 miles SW of Rockford, IL Exelon Generation Co., LLC
Clinton
BWR
23 miles SSE of Bloomington,
IL Exelon Generation Co., LLC
D.C. Cook 1
PWR
13 miles S of Benton
Harbor, MI Indiana/Michigan Power Co.
D.C Cook 2
PWR
13 miles S of Benton
Harbor, MI Indiana/Michigan Power Co.
Davis-Besse PWR 21 miles ESE of Toledo, OH FirstEnergy Nuclear Operating Co.
Dresden 2
BWR 25 miles SW of Joliet, IL Exelon Generation Co., LLC
Dresden 3 BWR 25 miles SW of Joliet, IL Exelon Generation Co., LLC
Duane Arnold
BWR
8 miles NW of Cedar
Rapids, IA NextEra Energy Duane Arnold, LLC
Fermi 2
BWR 25 miles NE of Toledo, OH DTE Electric Company
La Salle 1
BWR 11 miles SE of Ottawa, IL Exelon Generation Co., LLC
La Salle 2
BWR 11 miles SE of Ottawa, IL Exelon Generation Co., LLC
Monticello
BWR
35 miles NW of
Minneapolis, MN
Northern States Power Company –
Minnesota
Palisades
PWR 5 miles S of South Haven, MI Entergy Nuclear Operations, Inc.
Perry 1
BWR 35 miles NE of Cleveland, OH FirstEnergy Nuclear Operating Co.
Point Beach 1
PWR
13 miles NNW of
Manitowoc, WI NextEra Energy Point Beach, LLC
Point Beach 2
PWR
13 miles NNW of
Manitowoc, WI NextEra Energy Point Beach, LLC
197

Prairie Island 1
PWR
28 miles SE of
Minneapolis, MN
Northern States Power Company –
Minnesota
Prairie Island 2
PWR
28 miles SE of
Minneapolis, MN
Northern States Power Company –
Minnesota
Quad Cities 1 BWR 20 miles NE of Moline, IL Exelon Generation Co., LLC
Quad Cities 2 BWR 20 miles NE of Moline, IL Exelon Generation Co., LLC

Region IV
Plant Name Reactor Type Location Owner/Operator
Arkansas Nuclear
1 PWR
6 miles WNW of
Russellville, AR Entergy Nuclear Operations, Inc.
Arkansas Nuclear
2 PWR
6 miles WNW of
Russellville, AR Entergy Nuclear Operations, Inc.
Callaway
PWR
25 miles ENE of Jefferson City,
MO Ameren UE
Columbia
Generating
Station BWR 20 miles NNE of Pasco, WA Energy Northwest
Comanche Peak 1
PWR 40 miles SW of Fort Worth, TX TEX Operations Company LLC
Comanche Peak 2 PWR 40 miles SW of Fort Worth, TX TEX Operations Company LLC
Cooper
BWR
23 miles S of Nebraska
City, NE Nebraska Public Power District
Diablo Canyon 1
PWR
12 miles WSW of San Luis
Obispo, CA Pacific Gas & Electric Co.
Diablo Canyon 2
PWR
12 miles WSW of San Luis
Obispo, CA Pacific Gas & Electric Co.
Grand Gulf 1 BWR 20 miles S of Vicksburg, MS Entergy Nuclear Operations, Inc.
Palo Verde 1
PWR 50 miles W of Phoenix, AZ Arizona Public Service Co.
Palo Verde 2 PWR 50 miles W of Phoenix, AZ Arizona Public Service Co.
Palo Verde 3
PWR 50 miles W of Phoenix, AZ Arizona Public Service Co.
River Bend 1
BWR
24 miles NNW of Baton
Rouge, LA Entergy Nuclear Operations, Inc.
South Texas 1 PWR 90 miles SW of Houston, TX STP Nuclear Operating Co.
South Texas 2 PWR 90 miles SW of Houston, TX STP Nuclear Operating Co.
Waterford 3 PWR 25 miles W of New Orleans, LA Entergy Nuclear Operations, Inc.
Wolf Creek 1
PWR 3.5 miles NE of Burlington, KS Wolf Creek Nuclear Operating Corp.

Abstract (if available)

Abstract The Arabian/Persian Gulf (the “Gulf”) is a unique and critical body of water. Home to over 150 offshore oil rig platforms, the highest density in the world, and with roughly 70% of the world’s desalination capacity located in this small body of water, the role that the Gulf plays both regionally and globally is a critical one. Over recent years, surrounding countries have embarked on introducing nuclear power to their energy supply to diversify their economies and reduce their dependency on oil. Current projections estimate that the Gulf could have as many as 20+ nuclear reactors in the region by 2030. ❧ The unique combination and concentration of these three major industries (desalination, oil, and nuclear) in the Gulf introduces a complex set of vulnerabilities and dependencies to each other, as they all share the same body of water for their operations. These industries work independently of each other

Linked assets

University of Southern California Dissertations and Theses

Conceptually similar

PDF

Thermally driven water treatment with membrane distillation: membrane performance, waste heat integration, and cooling analysis

PDF

Long-term performance of nuclear waste storage systems under extreme loading conditions

PDF

Developing frameworks to quantify the operational and environmental performance of energy systems within the context of climate change

PDF

Integrating systems of desalination and potable reuse: reduced energy consumption for increased water supply

PDF

The roles of surface and pore properties in wetting resistance for membrane distillation membranes

PDF

Radar remote sensing of permafrost landscapes and active layer soil properties

PDF

Groundwater contaminant transport predictions in a sustainable water management scenario

$Hydraulic fracturing and the environment: risk assessment for groundwater contamination from well casing failure$

PDF

Hydraulic fracturing and the environment: risk assessment for groundwater contamination from well casing failure

PDF

Investigating the role of climate in affecting residential electricity consumption through high spatiotemporal resolution observations

PDF

Understanding the formation and evolution of boundaries and interfaces in nanostructured metallic alloys

PDF

The paradox of personalism: internal political constraints on nuclear posture in authoritarian regimes

PDF

Comprehensive uncertainty quantification in composites manufacturing processes

PDF

The educational and professional choices of Iranian women in STEM doctoral programs

PDF

Physico-chemical characteristics and sources of ambient PM mass and number concentrations and their associated toxicity, and development of novel techniques for high time-resolution measurement o...

PDF

Pathways to nuclear weapon reversal: exploring mechanisms and understanding non-proliferation policy

PDF

Total systems engineering evaluation of invasive pediatric medical therapies conducted in non-clinical environments

PDF

Impact of virtual reality (VR)-based training on construction robotics remote-operation

PDF

Artistic control combined with contact and elasticity modeling in computer animation pipelines

PDF

Dynamics of water in nanotubes: liquid below freezing point and ice-like near boiling point

PDF

Risk assessment, intrinsic interpolation and computationally efficient models for systems under uncertainty

Asset Metadata

Creator Alhanaee, Ghena (author)

Core Title Interdependency of the water-oil-nuclear industries in the Persian/Arabian Gulf: understanding risk and improving prevention and preparation of disasters

School Viterbi School of Engineering

Degree Doctor of Philosophy

Degree Program Civil Engineering

Publication Date 09/28/2020

Defense Date 08/26/2020

Publisher University of Southern California (original), University of Southern California. Libraries (digital)

Tag Arabian Gulf,desalination,interdependency,Middle East,nuclear,OAI-PMH Harvest,oil,Persian Gulf

Language English

Contributor Electronically uploaded by the author (provenance)

Advisor Meshkati, Najmedin (committee chair), Masri, Sami (committee member), Nugent, Jeff (committee member), Sanders, Kelly (committee member)

Creator Email alhanaee@usc.edu,galhanaee@gmail.com

Permanent Link (DOI) https://doi.org/10.25549/usctheses-c89-379081

Unique identifier UC11665831

Identifier etd-AlhanaeeGh-9023.pdf (filename),usctheses-c89-379081 (legacy record id)

Legacy Identifier etd-AlhanaeeGh-9023.pdf

Dmrecord 379081

Document Type Dissertation

Rights Alhanaee, Ghena

Type texts

Source University of Southern California (contributing entity), University of Southern California Dissertations and Theses (collection)

Access Conditions The author retains rights to his/her dissertation, thesis or other graduate work according to U.S. copyright law. Electronic access is being provided by the USC Libraries in agreement with the a...

Repository Name University of Southern California Digital Library

Repository Location USC Digital Library, University of Southern California, University Park Campus MC 2810, 3434 South Grand Avenue, 2nd Floor, Los Angeles, California 90089-2810, USA