Common-cause failure

The terms common cause and common mode have been used interchangeably in published literature, causing confusion. ANSI/ISA-84.00.01-2004-1 defines a common-cause failure as failure, which is the result of one or more events, causing failures of two or more separate channels in a multiple channel system, leading to system failure. A common-mode failure is defined as failure of two or more channels in the same way, causing the same erroneous result. It should be noted that common-cause failures can be random or systematic. Some examples of common-cause failures include  

Environmentai, e.g., temperature extremes, humidity, corrosion, EMC, vibration. Radio Frequency interference (RFi), eiectrostatic discharge, mechanical shock (random) 

Process physical properties, e.g., temperature, corrosion, plugging, chemical attack (random) 

Single elements, e.g., common-process connections, energy sources (random) 

Maintenance, e.g., tools, procedures, calibration, training (systematic) 

---

Identification and quantitative estimation of common-cause failures are general problems in fault tree analysis. Boolean approaches are generally better smted to mathematically handle common-cause failures. 

Take common cause failures into account while evaluating reliability... 

Use staggered proof testing to reduce chances of common cause failure... 

Electrical, electromagnetic, or radio frequency interference causes malfunction of the BPCS and SIS. Potential for common cause failure. 

The Committee is unable to determine whether the absolute probabilities of accident sequences in WASH-1400 are high or low, but it is believed that the error bounds on those estimates are, in general, greatly understated. This is due in part to an inability to quantify common cause failures, and in part to some questionable methodological and statistical procedures. 

System models assume the independent probabilities of basic event failures. Violators oithis assumed independence are called Systems Interactions, Dependencies, Common Modes, or Common Cause Failure (CCF) which is used here. CCF may cause deterministic, possibly delayed, failures of equipment, an increase in the random failure probability of affected equipment. The CCF may immediately affect redundant equipment with devastating effect because no lime is available for mitigation. If the effect of CCF is a delayed increase in the random failure probability and known, time is available for mitigation. 

Appendix HI, of WASH-1400 presents a database from 52 references that were used in the study. It includes raw data, notes on test and maintenance time and frequency, human-reliability estimates, aircraft-crash probabilities, frequency of initiating events, and information on common-cause failures. Using this information, it assesses the range for each failure rate. 

This chapter overviews the techniques for incorporating external events into a PSA. The discussion was primarily aimed at nuclear power plants but is equally applicable to chemical process plants. The types of external events discussed were earthquakes, fires and floods. Notably absent were severe winds and tornados. Tornados are analyzed as missiles impacting the structures and causing common-cause failures of systems (EPRINP-768). Missile propagation and the resulting damage is a specialized subject usually solved with computer codes. 

Waller, R. A., A Brief Survey and Comparison of Common Cause Failure Analysis, June 1985... 

Smith, A. M. and I. A. Watson, 1980, Common Cause Failures A Dilemma in Perspective. Reliability and Maintainability Conf. pp 127-142. 

Vescly, V. E., 1977, Estimating Common Cause Failure Probability in Reliability and Risk Analyses Marshall-Olkin Specializations, Proc. Int. Conf. Nucl. Systems Rel. Eng. F ment, Gatlinburg, TN, June. 

Virolainen, R 1984, On Common Cause Failures Statistical Dependence and Calculation of Uncertainty Disagreement in Interpretations of Data, Nuc. Eng. and E 77 pp 103-108. 

Analysis of Dependent Failure Events and Failure Events Caused by Harsh Environment Conditions Nuclear 700 events representing common cause failures and failures caused by harsh environments Licensee Event Reports on failures of 26 component and subcomponent types listed below 94. 

This is a letter report from JBF Associates Inc., to Sandia National Laboratories (SNL) summarizing JBF s efforts to analyze dependent (common cause) failures and failures caused by harsh environments. The information used for the analysis was ta)cen from over 1000 failure reports (mostly abstracts of LERs that were assembled for other studies). The 26 groups of components selected for study are accumulators, batteries, cables, control rod drives,... 

The bulk of the information in the report is included in a 317-page appendix that contains systems descriptions, station blackout fault trees, diesel generator historical data, and diesel generator common cause failure analysis results for 18 different nuclear power plants. Tables and graphs are well organized and present data correlated to each plant studied. The study also contains conclusions and recommendations for improving reliability. 

Failure sequence modeling techniques such as fault tree analysis or event tree analysis are used to estimate tlie likelihood of incidents in facilities where historical data is unai ailable, or is inadequate to accurately estimate tlie likelihood of the liazardous incidents of concern. Otlier modeling tecluiiques may be required to consider tlie impact of external events (eartliquakes, floods, etc.), common cause failures, and human factors and hmnan reliability. 

Occasionally an incident occurs that results in a common mode failure. This is a single event that affects a number of pieces of hardware simultaneously. For example, consider several flow control loops similar to Figure 11-4. A common mode failure is the loss of electrical power or a loss of instrument air. A utility failure of this type can cause all the control loops to fail at the same time. The utility is connected to these systems via OR gates. This increases the failure rate substantially. When working with control systems, one needs to deliberately design the systems to minimize common cause failures. 

Identification and quantitative estimation of common-cause failures are general problems in fault tree analysis. Boolean approaches are generally better suited to mathematically handle common-cause failures. The basic assumption is that failures are completely independent events, but in reality dependencies will exist and these are categorized as common cause failures (CCFs). Both qualitative and quantitative techniques can be applied to identify and assess CCFs. An excellent overview of CCF is available (AIChE-CCPS, 2000). 

In the case of malicious acts, the layers or rings of protection must be particularly robust because the adversaries are intentionally attempting to breach the protective features and can be counted on to use whatever means are available to be successful. This could include explosions or other initiating events that result in widespread common-cause failures. Some particularly motivated adversaries might commit suicide while attempting to breach the security layers of protection. 

For example, failures which do not initially influence the course of the process might not be corrected without delay. If this is true then it cannot be ruled out that a second failure can occur before the first failure has been corrected. The same applies to covert failures. These types of failures should be treated as dependent or common cause failures. 

Mosleh, A. et al. Procedures for Treating Common Cause Failures in Safety and Reliability Studies. Palo Alto, CA Electric Power Research Institute. 1988. (EPRI NP-5613)... 

Notice the event labeled Drain/vent valve plugged appears on two branches of the tree. This illustrates the concept of common cause failure. 

The electric back-up to this process is independent of that of the isolation system, the diesel generator is a different brand and capacity, therefore common cause failure will not be considered (Fullwood, 2000). The activation of the neutralisation process is carried out by the emergency system EAS-200, and leak detectors AI201 and AI202, as shown in Figure 4. 

Functional diversity can be implemented to defend the system against common cause failures. 

---