Handbook of Reliability, Availability, Maintainability and Safety in Engineering Design - Part 59 pdf

564 5 Safety and Risk i n Engineering Design structural dependencies. For each sequence of the event tree, the fault trees of the composing events are linked in one large fault tree that follows the logic depicted in the event tree, and the fault tree is then solved with the usual techniques to compute the p robability of occurrence of that sequence. Figure 5.12 shows the previous example of an initiating event that requires two systems, S 1 and S 2 , to intervene, where both systems are explicit on the event tree without care to their dependence. The hazardous event (accident and/or incident) sequences in Fig. 5.12 may now be calculated using Bayes’ theorem of conditional probability: (I)(S 1 )(S 2 )=P(S 2 |S 1 I)P(S 1 |I)P(I) (I)(S 1 )(F 2 )=P(F 2 |S 1 I)P(S 1 |I)P(I) (I)(F 1 )(S 2 )=P(S 2 |F 1 I)P(F 1 |I)P(I) (I)(F 1 )(F 2 )=P(F 2 |F 1 I)P(F 1 |I)P(I) (5.4) If the probab ility of the sequence (I)(S 1 )(S 2 ) is to be evaluated, a fault tree is developed with the top event occurring when the initiating event I, and the failure of both systems S 1 and S 2 occur. In place of the events S 1 and S 2 , the corresponding system fault trees can be substituted, thu s obtaining a large fault tree that can be logically simplified (accounting for the existing dependencies) and evaluated so as to give the probability of the top event, i.e. the probability of the sequence of interest. With this method, the dependencies are properly treated even if the analysis had, a priori, no information that the dependency existed. This is particularly useful in evaluating systems for safety critical consequences during the engineering design stage when information concerning the d ependencies of hazardous events is still System 1 success state S1 System 2 S2 (I) (S1) (S2) System 2 F2 (I) (S1) (F2) (I) (F1) (S2) (I) (F1) (F2) System 2 S2 System 2 F2 System 1 failed state F1 Initiating Event E1 Fig. 5.12 Event tree with fault-tree linking 5.2 Theoretical Overview of Safety and Risk in Engineering Design 565 vague. Conversely, the resulting fault tree for an accident sequence may b e rather large, necessitating more time for safety analysis during the design stage. In summary, all the significant dependencies of hazardous events among systems are explicitly represented in the event trees with boundary conditions. The fault trees for the individual events are then simple and independent. However, great care must be taken in identifying all the existing dependencies. In the fault-tree link approach, dependencies of hazardous events are included in the fault trees for the various systems and, thus, are not dependent. The accident sequence in the linked fault tree is rather large and complex but all dependencies are treated automatically. In Fig. 5.13, a simplified version o f a functional event tree is illustrated for the case of a pipe rupture in the primary cooling circuit of a nuclear reactor. It is evident from these simplified event trees that for realistic systems, event tree analysis and, thus, safety analysis in engineering design can become quite complicated. 5.2.1.4 Cause-Consequence Analysis for Safety in Engineering Design The cause-consequence analysis (CCA) method or, alternatively, the cause- consequencediagram (CCD) method is a tool forsystem safety and risk analysis. As with the fault-tree analysis method, the cause-consequence diagram documents the failure logic of the system. In addition to this, the cause-consequence diagram pro- duces the exact failur e probability in an efficient calcu lation p rocedure. The cause- consequence diagram technique, as applied to static systems, has been shown to yield the same result as those produced by the solution of the equivalent fault tree and binary decision diagram. On this basis, general rules have been devised for the construction of a cause-consequence diagram, given a static system. The use of the method in this manner has significant implications in terms of efficiency of con- ducting safety analysis, and can be shown to have benefits for determining safety in engineering design. Safety analysis of industrial systems is carried out to reduce the risk of adverse events such as injury or death, as well as to aid in the protection of systems and facilities, by reducin g the frequency or consequences of accide nts and/or incidents. Since the early 1960s, various mathematical models have been used to perform re- liability analysis in order to predict the likelihood that a system will function under a given demand. Each analysis model had different features that made it more ap- propriate to specific types of systems, and the most efficient analysis was to utilise the simplest technique. The most commonly employed technique to assess the prob- ability of failure of industrial systems is fault-tree analysis (FTA). For systems containing independent failure events, it has been shown that the FTA technique produces a logical description of the failure process and yields, among o ther results, the system’sunreliability.It has been highlighted, however, that this technique has limitations even when it is applied to systems containing indepen- dent failure events, in that the structural extent of backward analysis for this tree- based deductive method quickly becomes multi-branch ed for complex systems, and in itself becomes complex. Qualitatively, if the fault tree is complex, the n finding the 566 5 Safety and Risk in Engineering Design Fig. 5.13 Function event tree for loss of coolant accident in nuclear reactor (NUREG 75/014 1975) 5.2 Theoretical Overview of Safety and Risk in Engineering Design 567 minimal cut sets can be time-intensive. In addition, the top event probability, found via the inclusion-exclusion formula, may also be computationally time-consuming if the system contains a moderate number of m inimal cut sets. In the past, this problem was solved by using a simple approximation for the probability of occurrence of the top event. These approximations, however, can be inaccurate if the likelihood of component failure is large. The problem of inaccu- racies due to approximation techniques has been alleviated by the development of the binary decision diagram (BDD) approach. BDDs are based on Bryant’s trees (Bryant 1986) to obtain the exact top event probability efficiently by expressing the system failure mod es a s disjoint paths. The calculation of the top event probabil- ity is achieved by summing the probabilities of these disjoint paths. This analysis procedure makes the BDD technique more efficient than the traditional FTA tech- nique. The BDDs, however, cannot be constructed from the system description, and are developed from the fault-tree representation of the system. During the conver- sion process, the BDD loses all the cau sality information that is represented in the fault-tree structure. In additio n to this, an inefficient ordering of the basic events can result in an excessively large diagram that can prove difficult to analyse, reducing the efficiency of the method. A technique has been developed that represents all system outcomes, given an initial event, on a diagram that contains a full textual description of th e systems behaviour, and produces an exact quantification of system failure prob a bility. This technique is based on the cause-consequence diagram (CCD) method developed at RISO Laboratories in Denmark in the 1970s to aid in reliability analysis of nuclear power p lant (Villemeur 1991). The cause-consequence diagram method involves the identification of the poten- tial modes of failure of individual components and then relates the causes to the ultimate consequences for the system. The consequences evaluated inclu de those that represent system failure as well as those that represent other systems behaviour. As all consequence sequences are investigated, the method can assist in identifying system outcomes that may not have been envisaged during the earlier design phases. Cause-consequence analysis (CCA) is most frequently applied to systems where the system state changes with time (Nielsen et al. 1975). Application of cause- consequence analysis to a static system, and development of rules for the construc- tion of a cause-consequence diagram representing a static system have been used in a high-integrity protection system (HIPS) to prevent the passage of a high-pressure surge in downstream vessels in a process engineering design (Ridley et al. 1996). The Cause-Consequence Diagram Method Cause-consequence diagramming is a technique that embodies both causal and con- sequence analysis. The technique provides a diagrammatic notation for expressing the potential consequencesofanevent(normally,ahazard)andthe factors that influ- ence the outcome. The basic notation is introduced in the context of the example in Fig. 5 . 14. In this diagram, the hazard is ‘ignition’. The final outcomes (or so-called 568 5 Safety and Risk in Engineering Design Fig. 5.14 Example cause- consequence diagram YES No fire Minor fire Major fire Alarm on Sprinkler on Ignition YES NO NO significant consequences) are shown in octagons and vary from ‘no fire’, ‘minor fire’, to ‘major fire’. The main factors that influence the outcomes are shown in ‘condition vertices’ (i.e. YES or NO branching), specifically ‘alarm on’ and ‘sprin- kler on’. The diagram shows that a major fire will occur as a resu lt of the ignition hazard only if both the sprinkler and alarm system fail. If the frequency with which the hazard will occur can be estimated, and the probability that the sprinkler and alarm systems will fail on demand (and, importantly, to what degree these failures are correlated), then the frequency with wh ich the hazard will give rise to this in- cident can be estimated. This is an essential step on the way to estimating the risk arising from the hazard. Symbols Used for a Cause-Consequence Diagram There are basically six types o f symbols used for constructing a cause-consequence diagram. These symbols include the decision box, fault-tree arrow, initiator triangle, time delay box, OR gate, and consequence box, as illustrated in Table 5.4. The cause-consequence diagram is thus developed from an initiating event, i.e. an event that starts a particular operational sequence, or an event that activates cer- tain safety systems. The cause-consequence diagram is comprised of two conven- tional safety analysis techniques, the fault-tree analysis (FTA) method and the event tree analysis (ETA) method. The event tree analysis method is used to identify the various paths that the sys- tem could take, following the initiating event, depending on whether certain sub- systems/components function correctly or not. The fault-tree analysis method is used to describe the failure causes of the sub- systems considered in the event tree part of the diagram. This relationship is shown in Fig. 5.15. 5.2 Theoretical Overview of Safety and Risk in Engineering Design 569 Table 5.4 Cause-consequence diagram symbols and functions SYMBOL FUNCTION The decision box represents the functionality of a component/system. The NO box represents failure to perform correctly, the probability of which is obtained via a fault tree or single component failure probability q i Fault tree arrow represents the number of the fault tree structure which corresponds to the decision box The initiator triangle represents the initiating event for a sequence where λ indicates the rate of occurrence YES Ft1 t = x hrs λ= NO Sprinkler on q i Time delay 1 indicates that the time starts from the time at which the delay symbol is entered and continues up to the end of the time interval in the delay symbol OR gate symbol: Used to simplify the cause- consequence diagram when more than one decision box enters the same decision box or consequence box Consequence box represents the outcome event due to a particular sequence of events Initiating event Consequence part: Identification of sequence depending on accident or incident limiting systems. Event tree analysis Causal part: Cause of accident or incident limiting systems. Fault tree analysis Fig. 5.15 Structure of the cause-consequence diagram 570 5 Safety and Risk in Engineering Design Rules for construction and quantification The cause-consequence diagram tech- nique has been applied to a static safety system and found to yield results similar to those produced by a conventional fault tree (Ridley et al. 1996). On the basis of this study, general rules have been devised for the correct construction of the cause- consequence d iagram, as given below. The use of the cause-consequence method in this manner has significant implications in terms of efficiency o f reliability analysis, and can be shown to have computational benefits for analysing static safety systems. Step 1. Component failure event ordering If th e order of failure is irrelevant, which is typically the case in a static system, then the CCD can be initiated by considering any of the components in the system. The analysis of the CCD should yield identical results regardless of the component or variable ordering; however, the actual diagrams may vary in size. The first step of CCD construc tion is there- fore deciding on the order in which component failure events are to be taken. To ensure a logical development of the causes of the system failure mode (i.e. initiating event), the ordering should follow the temporal action of the system, or the system’s activation for the function required. Step 2. Cause-consequence diagr am construction The second stage involves the actual construction of the CCD. Starting from the initiating component, the func- tionality of each component or sub-system is investigated and the consequences of these sequences determined. If the decision box is governed by a sub-system, then the probab ility of failure will be ob tained via a fault-tr ee diagram. Step 3. Reduction If any decision boxes are deemed irrelevant (for example, the boxes attached to the NO and YES branches are identical, and their outcomes and consequences are the same), then these should be removed and the diagram reduced to a minimal form. Removal o f these boxes will in no way affect the end result. Th is is illustrated in Fig. 5.16 where failure (F) can occur due to either of the two paths that terminate in the same failure fu nction consequence, affecting either the NO or YES branches of component A. On one path, the component (A) works, on the other it fails, proving that the state of component (A) represented by the decision box is irrelevant. When a redundant Fig. 5.16 Redundant decision box 5.2 Theoretical Overview of Safety and Risk in Engineering Design 571 decision box is identified, reduction is achieved by removing the box and replacing it with the next decision/consequence box. When no further redundancies exist, the cause-consequence diagram is deemed minimal. Step 4. System failure quantification The probability of each consequence for a static system is determined by su mming the probability of each set of events that lead to this particular outcome. Each sequence probability is obtained by simply multiplying the probabilities of the component events represented by the branch. This is possible b ecause each sequence of events is mutually exclusive, and the probability of a component failure event is assumed independent. Three-component systems The cause-consequence diagram approach for static systems can be demonstrated by a very simple system example. The approachshows that it has potential advantages in comparison to a conventional fault-tree analysis for larger systems. The system example contains three components A, B and C, and system failure is caused by either A and B failing together, or C failing alone. The system failure causes are illustrated as a fault-tree structure in Fig. 5.17. The cause-consequence diagram can be constructed according to the following steps: Step 1. Componentfailure eventordering The ordering chosen is that of A, B and C. Step 2. Cause-consequence diagram construction The CCD is constructed by in- specting the failures of the components in that order (refer to Fig. 5.18). Step 3. Reduction Boxes 3 and 4 are both irrelevant and are therefore removed. This process reduces the CCD, the final form being illustrated in Fig. 5.19 and, as no further redundancies exist, the diagram is minimal. Step 4. System failure quantification The probability of system failure is equal to the sum of the probability of the three sequence paths that lead to the conse- Fig. 5.17 Example fault tree indicating system failure causes TOP G1 Function C Function A Function B C AB 572 5 Safety and Risk in Engineering Design Fig. 5.18 Cause-consequence diagram for a three-component system 5.2 Theoretical Overview of Safety and Risk in Engineering Design 573 quence ‘F’. Therefore, since the paths are mutually exclusive: Probability of failure = P(path 1 )+P(path 2)+P(path 4) = q A ·q B + q A ·(1−q B ) ·q C +(1−q A ) ·q C = q A ·q B + q A ·q C −q A ·q B ·q C + q C −q A ·q C = q A ·q B + q C −q A ·q B ·q C The fault-tree quantification calculates the top event probability to be iden tical to that obtained by the cause-consequence diagram approach. By studying the reduced form of the CCD, it can be noted that it is equivalent to the binary decision diagram (BDD) for the fault tree in Fig. 5.17 with the variable ordering A < B < C, as il- lustrated in Fig. 5.20. The top event probability can also be obtained directly from the BDD by multiplying the probabilities down the paths that lead to the terminal 1 node. Fig. 5.19 Reduced cause- consequence diagram Fig. 5.20 BDD with variable ordering A < B < C . the method in this manner has significant implications in terms of efficiency of con- ducting safety analysis, and can be shown to have benefits for determining safety in engineering design. Safety. Function B C AB 572 5 Safety and Risk in Engineering Design Fig. 5.18 Cause-consequence diagram for a three-component system 5.2 Theoretical Overview of Safety and Risk in Engineering Design 573 quence. event tree analysis and, thus, safety analysis in engineering design can become quite complicated. 5.2.1.4 Cause-Consequence Analysis for Safety in Engineering Design The cause-consequence analysis