Common-mode failure causes

Common Mode Failure An event having a single cause with multiple failure effects, which are not consequences of each other. 

Occasionally an incident occurs that results in a common mode failure. This is a single event that affects a number of pieces of hardware simultaneously. For example, consider several flow control loops similar to Figure 11-4. A common mode failure is the loss of electrical power or a loss of instrument air. A utility failure of this type can cause all the control loops to fail at the same time. The utility is connected to these systems via OR gates. This increases the failure rate substantially. When working with control systems, one needs to deliberately design the systems to minimize common cause failures. 

Common Cause or Common Mode Failure—Failure, which is the result of one or more events, causing coincident failures in multiple systems or on two or more separate channels in a multiple channel system, leading to system failure. The source of the common cause failure may be either internal or external to the systems affected. Common cause failure can involve the initiating event and one or more safeguards, or the interaction of several safeguards. 

The objective of the CMA is to identify aU possible common mode failures which have the potential to fail, or degrade, system redundancy or to cause another initiating event leading to system failure. 

Although not a recommendation in the accident report, it can be speculated that this feedback system (which can cause a Catastrophic functional failure, see Section 1.3.6) is vulnerable to a common mode failure (see Chapter 6 Step la) and should have been provided by independent means. 

Sufficient measures have to be implemented to protect the system from common cause failures and common mode failures ... 

Failure of two or more structures, systems, and components in the same manner or mode due to a single event or cause. Common mode failure is a type of common cause faUuie in which the structures, systems, and components fail in the same way. 

Often reliability engineering practitioners make the assumption that all common-cause failures are common-mode. This is a conservative assumption and simplifies modeling. For the purpose of this guideline, all common-cause failures are synonymous with common-mode failure. ... 

In standards, it is recommended that the devices, systems, or protection layers be assessedfor independence, and potential for common cause failure. Common cause failure can cause multiple devices, systems, or layers to fail simultaneously. Another term is common mode failure (a subset of common cause failure), which describes the simultaneous failure of two devices in the same mode, for example, two redundant transmitters fail simultaneously and are disabled due to loss of signal (common mode failure) [10,11]. 

Layers of protection There are many independent layers of protection provided in the control measure in addition to the basic process control system. These layers of protection make the control measures more robust. Fig. 11/4.5.4-1 may be referred to for more detail. Detailed discussions are available in Chapter V. Common mode failure Common mode failure refers to the failure of more than one control system on account of a common cause, which underlines the importance of independent layers of protection. However, common cause can affect both engineering and administrative controls. So, while considering the adequacy of control measures used for risk prevention/reduction/mitigation, etc. it is necessary and important to see that all such control measures are not only independent but also do not suffer from common mode fculure—discussed in later part of the book. 

Common mode failure Failure of two or more channels/devices in a redundant configuration, on account of the same failure mode, causing the same erroneous result. 

Two major classes of system failure can occur when component dependence occurs common cause failures and common mode failures. A common cause failure (CCF) is the failure of two or more components in a system due to the same event but where the failures are not consequences of each other. For example, if two components in a system that are both more likely to fail under humid conditions fail on a very humid day, this is a CCF. CCFs are especially likely in systems that use similar components redundantly to increase reliability because such components are affected similarly by environmental conditions. The second type of system failure that occurs due to component dependence is the common mode failure (CMF). A CMF is the failure of two or more components in a system where the failure of one component causes the other components to fail. This form of system failure is of special concern in Perrow s work (1984). Perrow argues that when complex, unanticipated interactions among components occur, redundant safety features can actually reduce the reliability of a system. 

The DAS is included wilhin the instrumentation and control architecture in order to support the risk goals in the APIOOO PRA for analyzed events. The DAS reduces the probability of a severe accident resulting from Ihe imlikely coincidence of a Postulated Initiating Event (PIE) and postulated common-mode failures in Ihe protection and control systems. Common-mode failure between the Protection and Safety Monitoring System and Ihe DAS is unlikely because each runs on a different operating system from the other, and there are no sensors shared between the two systems (see Section 8.4.4.4 of this chapter for a further enhancement to the DAS to reduce common-cause failure even more). 

Functional safety assessment checklists, truth tables, failure analysis, common-cause (or common-mode) failure analysis, reliability block diagrams... 

This section describes the potential causes of common mode failure (CMF), how we can design l C systems to prevent CMF, and how we can take possible CMF into account when doing plant risk assessments. It addresses both software and hardware systems and components. Common mode failure can also be referred to as common-cause failure or dependent failure. Some people may say that there are subtle differences between these terms, but let us keep it simple. 

A list of possible causes of common-mode failure is given in Table 2.2. 

The control and protection systems should be electrically and physically separated to try to eliminate common-mode failures between control systems and protection systems. At no point should there be a direct electrical connection between a control system and a protection system. Any required electrical signal connection (e.g., communications) should be via buffered links, e.g., opto-isolators. Electrical separation includes also the power supplies for the systems. In general, the power suppUes should be sourced from different transformers, and the RPS should use guaranteed supplies. The systems shall also be physically separate, ideally with physical/fire barriers in between. These measures are necessary to prevent commonmode or common-cause failures. 

A common cause failure (CCF) causes a failure in two or more elements that can be traced back to a cause or to a single event. A special form is the common mode failure (CMF). This failure is often traced back to the same elements, which cause the same failure behavior for a single event in both redundancy paths. This could also be the case of two different elements that for example drift in the same failure direction in case of overheating. Therefore, the redundancy would be neither reactionless nor sufficiently independent for i.e. decomposition (Fig. 5.61). 

CCFs and common mode failures (CMFs) are similar in nature in that they are both involved with the simultaneous loss of redundant equipment to a single shared cause. However, they differ by the type of the single shared causal event that causes the redundant items to fail simultaneously. A CCF is caused by an external event, whereas the CMF is caused by an identical failure internal to each item. CMFs normally fail in the same functional mode. Quite often, CMFs are (erroneously) referred to as CCFs. Although it is reasonable to include CMFs under the CCF umbrella, CCFs are much larger in scope and coverage. Figure 2.10 shows this conceptual difference between CCF and CMF. Note that the boxes represent redundant system elements, and the redundancy is effectively shunted by the CMFs and CCFs. Redundancy is the key for identifying CCFs and CMFs. 

See Common Cause Failure Analysis (CCFA) and Common Mode Failure (CMF) for additional related information. 

Common mode failure Inner and outer tube failure due to a common cause. 

FMEA may be conducted on hardware, system fimctions, may also include software and people. Common Mode Failures (CMF) are covered by FMEA. The causes for CMF-s can be classified into five main categories ... 

The assumptions of barrier independence may apply to foreseeable technical failures. There are, however, many case histories in the literature, where unforeseen common-mode failures introduced by the operators or maintenance personnel have caused multiple barrier breakdowns. Due to the complexity of the system, the operators have not been able to understand the situation and foresee the consequences of their actions. 

The primary system level safety requirement which drives risk control is failure tolerance. Failure tolerance embraces many design approaches. These include, but are not limited to functional redundancy functional inhibits safety devices manual back-up to automatic functions benign failure modes and failure effect isolation and containment. Damage tolerance (fracture control) and safety factor requirements are applied to structures as an equivalent to functional failure tolerance, although structural failure tolerance is acceptable where it can be implemented. Common cause and common mode failure mechanisms are taken into account in the implementation of Failure Tolerance. 

A common cause (or a common mode) failure concerns the possibility that system failure involving multiple item failure may occur due to a common cause, i.e., the loss (during some critical period) of multiple or redundant paths/components/parts/ functions due to an underlying common mechanisms/faults/phenomenon. A common mode failure is a failure which has the potential to fail more than one function and to possibly cause an initiating event, or other event(s), simultaneously. 

---