IMPACT OF DEPENDENT FAILURE ON SIL ASSESSMENT

Transcription

1 IMPACT OF DEPENDENT FAILURE ON SIL ASSESSMENT Alan G King ABB Engineering Services, Pavilion 9, Belasis Hall Technology Park, Billingham, Cleveland TS23 4YS, UK; Tel: þ44 (0) , Fax: þ44 (0) , alan.g.king@gb.abb.com Over the last five years or so, the operators of chemical sites and other high hazard facilities have been considering the implications of functional safety standards such as IEC and the sector specific standards derived from IEC These standards offer guidance on the management of functional safety systems and provide an approach the demonstration that the risk to people and the environment is being managed appropriately. As part of the management process, it is necessary to undertake a hazard and risk assessment to determine the amount of risk reduction required to be provided by electrical, electronic or programmable electronic safety related systems. The output of this process is a Target Safety Integrity Level (SIL) for each safety instrumented function. The demonstration of appropriate management of risk then requires that the, as designed and implemented, safety function achieves a performance (designed or achieved SIL) that at least meets the target SIL. The methods and techniques commonly used for hazard and risk analysis and the determination of target SIL frequently make the assumption that all the relevant protective measures are considered to be independent. This paper will address the significance of dependent failure and the vital importance of its consideration both in relation to the assessment of the target SIL and with respect to the designed or achieved SIL. It will note that failure to consider dependent failure may lead to a level of risk that is one or more orders of magnitude higher than intended. The paper will conclude with some examples of the type of dependency that can be encountered and the significance of its impact. BACKGROUND Dependent failure has for several decades been recognised as a highly important issue but largely in the nuclear industry. In contrast, in the process sector it has not been recognised as an issue of importance to the extent that it really warrants. With the increasing use of techniques for the assessment of Safety Integrity Levels as part of the application of standards such as IEC [1] and IEC [2], it is vitally important that the process sector gains sufficient understanding of the issues raised by dependent failure and how to deal with them. Failure to do this will lead to increasing numbers of inadequate assessments and the hand-over of poor guidance to the next generation of engineers. Furthermore, assessments, that fail to recognise dependent failure and to take it into account, are likely to lead to the insufficient provision of risk reduction measures across the industry, with the resulting levels of risk significantly higher than the assessments indicate. These risk levels may well be higher by one or more order of magnitude. SCOPE This paper will cover some of the common cause or dependency issues that occur in SIL Assessments. It will also provide some examples to highlight these issues, showing where and how they can occur. #2007 ABB Engineering Services. Third parties have access for limited use and no right to copy any further. IChemE have intellectual property rights to make this paper avialable but ABB are the copyright owners WHAT IS DEPENDENT FAILURE Dependent failure can be classified in one of two types: (a) Classic Dependency and (b) Functional Dependency. CLASSIC DEPENDENCY Classic dependency is what is often referred to as common cause failure or common mode failure. It can occur where two or more functional units are similar and are operating under the same conditions. Classic dependency occurs when the trigger for the failure of one unit affects others and causes failure of them at or around the same time. For example, two pressure sensors sensing the pressure in a particular vessel will probably be of similar types, close together in the same environment and will be sensing the same process fluid. FUNCTIONAL DEPENDENCY Functional dependency is where a group of two or more functional units depend for their correct operation on the correct functioning of another single unit. Typical examples would include a single sensor used to provide a signal to operate both an alarm and a trip function. Failure of the sensor would affect both the alarm and the trip. DEPENDENCY RELATING TO PEOPLE Dependency affecting items of equipment is comparatively well recognised; what is much less well recognised is that there can be dependency associated with human actions. Examples include: 1

2 . People doing the same task can make the same error.. People, using the same equipment at different times, can make a similar error using it.. Two or more tasks carried out by the same person same error repeated on each task.. One person checking the work of another the checker fails to detect the error that the first person missed, for the same reason. Dependency can also affect a combination of equipment and people. For example, a sensor monitoring process pressure may be used to control the process pressure but also to provide an alarm for the control room operators on high pressure. The sensor fails and reads low. The control function will seek to increase the process pressure. The operator receives no alarm and is therefore not prompted to take action. Furthermore, any review of the pressure indication by the operator would suggest that the pressure is low and therefore no action is required 1. PROTECTION LAYER MODEL It is commonplace to consider the control and protective measures on a process as a Layered Model. A typical illustration of this is given in Figure 1. Simple analysis for safety integrity level assessments assumes that there is complete independence: (a) the failures of different measures within a single layer are independent and (b) the failure of measures in one layer is not linked to the failure of the measures in another layer 2. In reality, there is often dependency that needs to be considered. DEPENDENCY WITHIN A LAYER An example of dependency within a layer is shown in Figure 2. It shows part of an instrumented protective function with three identical pressure sensors monitoring the same process pressure. There is potential here for common cause failure of all three pressure transmitters. Figure 1. Protection layer model DEPENDENCY BETWEEN LAYERS Dependency between layers is often more difficult to recognise. In Figure 3, the same three pressure sensors are monitoring pressure but in this case, each is associated with a function in a different layer (1) a control function (2) an alarm function and (3) an automated trip function. The potential for common cause or dependent failure still exists, but the analysis is more challenging. In Figure 4, we have another example with potential dependency between layers. In this example, the control and alarm functions are sharing a transmitter. This is a functional dependency: dangerous failure of PT1 means immediate loss of control and no alarm due to sharing across layers. The potential for common cause failure of both pressure transmitters also exists and would result in a loss of control, alarm and trip functions. HOW IS THE MAGNITUDE OF DEPENDENT FAILURE ASSESSED A typical safety instrumented function is shown in Figure 5 with a 1oo2 voting arrangement between the sensors and also between the final elements. There may also be redundancy and voting within the logic solver. Wherever there is 1oo2 or other voting, dependency needs to be considered. If we look at the two sensors in Figure 5, the working and failure states can be illustrated as in Figure 6. The most widely used method for assessing the proportion dependent failures is the Beta Factor Method. 1 It is recognised that in some situations there will be other indications that the operator can use to assess whether there is a process problem or not. 2 This is the underlying assumption in Layer Of Protection Analysis, Event Tree Analysis etc. Figure 2. Dependency within a layer 2

3 Figure 5. Typical safety function provides what is a rather complex equation: Figure 3. Dependency between layers (1) BETA FACTOR METHOD In this method, the Beta Factor (b) is defined as: PFDavg ¼ 2 ((1 b D )l DD þ (1 b)l DU ) 2 l DU T i l D 2 þ MTTR þ l DDMTTR l D l DU T i l D 3 þ MTTR þ l DDMTTR l D þ (b D l DD MTTR) T i þ bl DU 2 þ MTTR Dependent Dangerous Failure Rate Beta FactorðbÞ ¼ Total Dangerous Failure Rate where: b l MTTR Ti Common Cause Beta Factor (b D is for detected by diagnostics) Failure Rate (D ¼ Total Dangerous Failures; DD ¼ Dangerous Detected; DU ¼ Dangerous Undetected) Mean Time to Repair Proof Test Interval For calculation of the average probability of failure on demand for a 1oo2 voting arrangement, IEC However, if we assume (a) that the mean time to repair is small compared with the Proof Test Interval and (b) that dangerous failures are only found at proof test (so that l DU ¼ l D and l DD ¼ 0), then the previous equation for 1oo2 simplifies and is more easily understood: PFDavg ¼ 4 3 (1 b)l T 2 i T i D þ bl D 2 2 fflfflfflfflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflfflfflfflffl} fflfflfflfflffl{zfflfflfflfflffl} Independent Common cause failure of both failure affecting sensors both sensors There are also similar equations for other voting arrangements: Figure 4. Dependency between layers (2) T 3 i T i 1oo3 PFDavg ¼ 2 (1 b)l D þ bl D 2 2 1oo4 PFDavg ¼ 16 5 (1 b)l T 4 i T i D þ bl D 2 2 3

4 Figure 6. Working and failure states for 1oo2 PUTTING SOME NUMBERS IN... For a single sensor with a PFDavg of and using a Beta Factor of 0.1, we can see in the following table the importance of including dependency in the calculation: Independent PFDavg Dependent PFDavg Total PFDavg 1oo2 2.43E-04 14% 1.50E-03 86% 1.74E-03 1oo3 4.92E % 1.50E % 1.50E-03 1oo4 1.06E % 1.50E % 1.50E-03 question is what is the probability that Person B does not detect the error that Person A has failed to notice? Answering these questions and taking dependency into account is not easy to do. The best guidance is Don t claim multiple layers of human reliability. This will avoid the issue of dependency. SOME EXAMPLES TO THINK ABOUT Here are two examples, to think about the implications of dependency on SIL Assessment. Omitting dependency makes a BIG difference in all the cases above, dependency is accounting for more than 85% of the total probability of failure. ASSESSING THE VALUE OF BETA The value of Beta is usually in the range from 30% down to 0.1%. The assessment of an appropriate value involves consideration of factors such as: Separation, Diversity & Redundancy, Complexity, Analysis, Procedures, Training, Environment Control, and Environmental Tests. There is some guidance in IEC Annex D. There is also guidance to be found in other publications [3]. Small Beta Factors are progressively more difficult to achieve. EXAMPLE 1 Figure 7 shows a process column with two notionally independent alarms: Level Alarm High (LAH) and Level Alarm High-High (LAHH). From a dependency perspective, the HUMAN DEPENDENCY If you include the impact of humans on functional safety (and one should in order to comply with standards) then dependency is an important factor. Dependency is when a failure at one step in a task makes the probability of failure at the a later step more likely than if the earlier step had been successful. Consider, for example, the task of Checking. Person A has completed a task and thinks it has been done fully and correctly. Person B is asked to check. Checking is only of value when Person A has made an error AND Person A has not realised the error has occurred. The key Figure 7. Example 1: two independent alarms 4

5 Figure 8. Example 2: section of plant alarm hardware will have some potential for common cause failure, especially if both use the same technology. However, both alarms are also dependent on the operator for any action to occur. This raises two critical questions: (1) How long does the operator have between the Level Alarm High (LAH) and a hazardous event 10 min, 20 min, 30 min or more? Is it enough for effective response? (2) If the operator fails to respond effectively to LAH in the time available but does notice LAHH, there is even less time for response; so does LAHH have any real risk reduction benefit? The answer to this last question is probably No. Figure 9. Initial analysis EXAMPLE 2 Figure 8 shows some pipework on a plant, which connects a high pressure (HP) section to a low pressure (LP) section. There is a defined start up routine to ensure that the two sections are isolated before the HP section pressure exceeds the rating of the LP section: (1) Check that block valves between HP and LP sections of plant are open (A&B) and bleed valve (C) is closed; (2) Raise pressure in HP section to 5 bar; (3) Close block valves (A&B), open bleed valve (C); (4) Continue raising HP pressure to 30 bar. Initial analysis of the potential frequency of over pressure of the LP section gives a value of 2.5 x / yr and is shown in Figure 9. It was then proposed that this be improved by the installation of a safety instrumented function to provide isolation in the event of an operator failing to close the manual valves. This is shown in Figure 10. The high pressure trip setting is 5.5 bar and is assumed in the analysis to have safety integrity level of SIL 1 and a failure probability of The analysis for Figure 10. Improved design 5

6 Figure 11. Analysis of improvement Figure 12. Revised analysis this is shown in Figure 11 and gives a frequency of 1.25 x /yr. However, at start-up the operators adopted the practice of (a) waiting for HP Trip to function as pressure increased and (b) then going to operate the manual isolation valves. The revised analysis for this is shown in Figure 12. The analysis now gives a frequency of 1.25 x /yr. The dependency between trip operation and manual valve closure is shown to increase the hazardous event frequency by a factor of 100. The analysis shown has been simplified to help illustrate the problem. In practice, there are a number of ways in which the situation may be improved. (a) Reinforcement of correct start-up procedure by management. (b) Recovery - the operators realising that the trip has not functioned and closing the manual valves late, but before damage to the LP section occurs. (c) Testing the trip just prior to start-up to achieve a significantly lower PFDavg. But the problem needs to be recognised before it can be addressed. CONCLUSIONS Dependency is very important in any form of SIL Assessment. The assessor needs to think carefully where it could occur this is often quite challenging. If you fail to consider it and omit dependency from your assessment, then the level of risk is likely to be significantly higher than you have assessed by one or more decades. Consideration of dependent failure is relevant no matter what technique for assessment you are using. Whether this be Event Trees, Fault Trees, LOPA or Risks Graphs dependent failure is important. ACKNOWLEDGEMENTS The author would like to acknowledge the many conversations with colleagues who have helped in the formulation of the matters discussed in this paper. REFERENCES 1. IEC 61508: Functional safety of electrical/electronic/ programmable electronic safety-related systems, International Electrotechnical Commission, Geneva, 1998 & IEC 61511: Functional safety Safety instrumented systems for the process industry sector, International Electrotechnical Commission, Geneva, UPM 3.1: A Pragmatic Approach to Dependent Failures Assessment for Standard Systems, V P Brand, AEA Technology,