Common part failures

Common part failure Three totally independent flying control systems may merge together in a common part - the pilots control column. A failure of this common part causes total system failure. 

Scenario 2 a dual redundant system may be compromised by a single failure, such as when the power supply cabling is routed via the same bus or circuit breaker (i.e. common part failure could cause total loss of system functionality). 

The Committee is unable to determine whether the absolute probabilities of accident sequences in WASH-1400 are high or low, but it is believed that the error bounds on those estimates are, in general, greatly understated. This is due in part to an inability to quantify common cause failures, and in part to some questionable methodological and statistical procedures. 

An equipment may have different failure modes involving different parts of the equipment. It can fail because of deterioration of mechanic parts (possible consequence is complete failure that requires equipment replacement) or electronic parts malfunction (partial failure that can be repaired). Different failure modes need different repair costs and repair times and induce different economic losses. The sampling of different failure modes of equipment is done as follows i) assign a probability of occurrence for each type of failure mode using information on how common a failure mode is, ii) at the simulated failure time of the equipment, the type of failure mode that actually occurred is sampled in accordance with the failure modes probability of occurrence. 

Furthermore, where multiple SISs are used, one should take into account common cause failures. In addition, all of the other requirements defined in lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (lEC 61511-1 Mod) should be satisfied, including the minimum fault tolerance requirements defined in Table 5. 

An important issue to be considered at an early stage is whether there are any common oause failures between redundant parts within each layer (for example, between 2 pressure relief valves on the same vessel), between safety layers or between safety layers and the BPCS. An example of this could be where failure of a basic process control system measurement could oause a demand on the safety instrumented system and a device with the same characteristics is used within the safety instrumented system. In such cases it will be necessary to establish if there are oredible failure modes that could cause failure of both devices at the same time. Where a common cause of failure is identified then the following actions can be taken. 

In terms of assessment sensitivity, it is the AND gates which are the vulnerable parts of the design. The reason for this is that, by definition of an AND gate, the event is only going to happen if more than one of the necessary conditions are met. These conditions are normally multifailnre events. Since the probability of the resulting top-level failure event is the multiplication of failure probabilities of the individual events, the result is that the top-level failure event is far less probable than the individual causes. However, any common cause failure could dramatically alter the probability of the top event. 

The explosive valves used in the liquid poison injection system in BWRs have the characteristic of not being subject to leaks as their closure is ensured by a membrane which is destroyed by the explosive charge. They, moreover, have a high reliability because of the absence of mobile mechanical parts. Operating experience, however, indicates a certain number of cases where the electric connections for their actuation were erroneously made, making the valve inoperable. If this mistake is due to erroneous installation instructions, then the latter comprise a dangerous common cause failure. 

Since software faults have a big Common Cause Failure (CCF) potential, it is sometimes imderstand to be a part of the hardware CCF of Central Processing Unit (CPU) or other programmable device. This approach makes a sense but it expects correlation between hardware and software which is probably very weak and hardly can dominate to the probability of software... 

Vaurio, J. K. (2006). Is mapping a part of common cause failure quantification Kemtechnik 71(1-2), 41-49. 

ABSTRACT Common cause failures (CCFs) are an important part of reliability analysis when working with safety instrumented systems (SIS), and engineers have been aware of these types of failures since the midseventies (Fleming, 1974). The purpose of this paper is to develop a strategy for analyzing CCFs by smdying an example of an oil-pressure system. This paper presents an example which the standard j8-factor model is unable to describe properly. 

In some cases, there is no weld at all—a condition known as an open knit line and which is uniformly regarded as an unacceptable part. Knit lines which are visible, but not open, can vary considerably in strength from 10% to approximately 75% of that of the surrounding material the harder to see, the better the knit line. In the author s experience, the maximum knit line strength was 85% of that of the surrounding material, with 50 to 65% being typical. Since they are the weakest link in the wall of a part, knit lines are one of the most common causes of plastic part failure. 

Efforts are being made to develop a new relational data base system of LMFBR component reliability data on an engineering work station. The system is based on CREDO (Centralized Reliability Data Organization), a cooperative project between PNC and the USDOE, which ended in 1992. As part of the data analysis reliability parameters were quantitatively estimated for sodium mechanical pumps, i.e., failure rates, probability of common cause failures and lepairability. Additionally, risk-related data on energy production systems such as solar photo voltaic energy system and LMFBR nuclear fuel cycle have been collected. 

Layers of protection There are many independent layers of protection provided in the control measure in addition to the basic process control system. These layers of protection make the control measures more robust. Fig. 11/4.5.4-1 may be referred to for more detail. Detailed discussions are available in Chapter V. Common mode failure Common mode failure refers to the failure of more than one control system on account of a common cause, which underlines the importance of independent layers of protection. However, common cause can affect both engineering and administrative controls. So, while considering the adequacy of control measures used for risk prevention/reduction/mitigation, etc. it is necessary and important to see that all such control measures are not only independent but also do not suffer from common mode fculure—discussed in later part of the book. 

As stated earlier, there are two types of failure random failure and systematic failure. There is another kind of failure called common cause failure. Common cause failure may be random or systematic failure. However, in ISA -TR84.00.02 2002 - part 1, this has been categorized under physical failure. However, in the note CCF of systematic failure has been mentioned. In this sub-clause, discussions shall be restricted to random failure only. The other two types will be separately in the subsequent subclauses. Random failures are physical failures. Random failure is characterized by unpredictable failure of device or component such as electronic card failure. As per ISA-TR84.00.02-2002 - part 1, a failure is classified as physical when some physical stress (or combination of stressors) exceeds the capability of the installed components. Random failures normally exhibits following characteristic features ... 

For each risk assessment/SIL determination study, dutyholders should be able to justify each claim, and data used in the risk assessment, and ensure that appropriate management systems and procedures are implemented to support those claims. For COMAEI top-tier sites this will form part of the demonstration required within the safety report. Of particular importance is the reliability and diversity of the independent layers of protection. To avoid common mode failures extreme care should be taken when claiming high reliability and diversify, particularly for multiple human interventions. 

Various failure and degradation mechanism have been identified that adversely impact the integrity of bolts used in safety related applications and in applications important to safety. Depending on the nature of the degradation mechanism a potential for common mode failures exists for same system or redundant system components. In addition, leaks from flanged joints represent a significant part of total number of leaks in primary circuit. 

The risk classification method in accordance with lEC 62061 is of general validity, and not only restricted to electrical control systems. Therefore, it can also be apphed to mechatronic control chains as ISO 13849-1 regards them. The requirement for a SF made of mechatronic components can thus be defined either with the informative decision tree, (wrongly called risk graph ) of ISO 13849-1, or with a risk classification in accordance with lEC 62061. Other parts of lEC 62061 however, for example the beta factors estimation for common cause failures, are not useable, when hydrauhc and pneumatic systems are used. 

Fig. 4.61 Illustration of a common cause failure (Source ISO 26262, part 1)...

According to the definitions in part 1 of ISO 26262, suflhcient independency can be achieved through the absence of cascading failure and of common cause failure. For freedom of interference only the absence of cascading failure needs to be shown. This is an interesting indication in the norm, but it contradicts with the following requirement ... 

In judging the adequacy of the means of shutdown, consideration shall be given to failures arising anywhere in the plant that conld render part of the means of shutdown inoperative (such as failure of a control rod to insert) or could result in a common cause failure. 

Thus, a common cause failure may simply be defined as any insfance where multiple parts/units/components fail due to a single cause [13]. Some of the causes for the occurrence of common cause failures are design deficiency, operation and maintenance errors, external normal environment, external catastrophe, common manufacturer, and common external power source. 

Checking identification of missing, incorrect, misshapen or wrongly orientated components. Also detection of foreign bodies, part-failure and machine in-operation. Common technologies include vision systems, tactile/pressure sensors, proximity sensors and bed of nails . 

Independence prevents (1) propagation of failures from system to system or (2) propagation of failures between redundant parts within systems, and (3) common cause failures due to common internal plant hazards. Independence is also important to ensure that the redundancy and diversity provided to ensure high reliability of systems importaut to safety are effective. 

---