Fault tree analysis independence

Frequency Estimation There are two primary sources for estimates of incident frequencies. These are historical records and the apphcation of fault tree analysis and related techniques, and they are not necessarily applied independently. Specific historical data can sometimes be usehiUy applied as a check on frequency estimates of various subevents of a fault tree, for example. 

Identification and quantitative estimation of common-cause failures are general problems in fault tree analysis. Boolean approaches are generally better suited to mathematically handle common-cause failures. The basic assumption is that failures are completely independent events, but in reality dependencies will exist and these are categorized as common cause failures (CCFs). Both qualitative and quantitative techniques can be applied to identify and assess CCFs. An excellent overview of CCF is available (AIChE-CCPS, 2000). 

Fault tree analysis is a rigorous method that can be used to determine the PFOa g or to supplement better estimates of individual initiating causes or independent protection layers (IPLs) in LORA. Fault tree is a deductive method for identifying ways in which hazards can... 

Step la This CMA process is performed to verify that AND events (e.g. in the Fault Tree Analysis (FTA) or Dependence Diagrams (DD), or any quahtative probabihty declaration) are truly independent. 

The modelling of the system unavailability is based on the results of the fault tree analysis and the identified minimal cut sets. The simplified equation for the time-dependent system unavailability, for mutually independent basic events, is ... 

Where multiple, diverse hazards exist, the practical approach is to treat each hazard independently, with the intent of achieving acceptable risk levels for all. In the noise and toluene example, the hazards are indeed independent. In complex situations, or when competing solutions to complex systems must be evaluated, the assistance of specialists with knowledge of more sophisticated risk assessment methodologies such as Hazard and Operability Analysis (HAZOP) or Fault Tree Analysis (FTA) may be required. However, for most applications, this author does not recommend that diverse risks be summed through what could be a questionable methodology. 

A more detailed application of LOPA requires sufficient rather than absolute independence between protection layers or between a protection layer and an initiating event. The principles within BS EN 61511 -1 and 61511 -2 (eg clauses 9.4, 9.5 and 11.2) present the requirements on the BPCS when used as a protection layer. For example a detailed evaluation would need to be performed of the possible failure modes of each element of the protection layer - typically involving techniques such as Failure Modes and Effects /Analysis, Human Reliability /Assessment and Fault Tree /Analysis. Great care needs to be taken in using this approach to ensure that consistent assumptions about the condition of equipment or people are made throughout the analysis. 

An important concept of fault tree analysis is that all the events and subevents are independent of each other. So for example in the CIRIA 152 fault tree the cause of ventilation cannot be dependent on a factor that also causes ignition (i.e. entry into the cupboard). 

Standard Fault Tree analysis rules apply, including a need to ensure that Base Events are independent from each other. It is possible that the same base event may lead to several different consequences, and hence appear in several places in the same model. In such cases it must be assumed that the base events and relevant data are described and justified within the specific context each time. 

In addition, it is the author s recommendation to perform at least a qualitative (or just illustrative) Fault Tree Analysis [10] going down the hazards, in order to check with all relevant experts how they could arise (based on the functional system architecture) and to show where reference is made to redundant elements, which require special considerations to prove their independence. ASIL decomposition can be better justified using a Fault Tree. 

In practice, most of the ground-based ATC barriers are implemented by the same controllers and equipment items so the barriers are not independent, and methods such as Fault Tree Analysis (FTA) are needed to apportion both success and failure targets to individual subsystems within the overall ATM system. 

AS r.dift lad iL v iifrtion or i iiiun.J c wk-di. failure and T., i. -did- riri d independent unavailability, d<)>.-cftid number of failures, and Cdi. dijcy of top event No Phased-mission analysis possible if fault tree is input, minini j1 cutsets will be calcuijidd rnc 7r/--r. Asail.iblc Ik -ii mvuuu-(. -nicT... 

Fault tree for overpressure example (Fig. VII/1.2.2-1). BPCS, basic plant control system C Valve, control valve E/E/PE, electrical/electronics/programmable electronics IPL, independent protection layer PHA, plant hazard analysis SIS, safety instrumentation system. 

The quantification process follows the large fault-tree linking method (Reference 4). The unavailability and unreliability values for the electric power system are obtained from a Markov model, which requires the setting of flags to turn parts of the linked model off and on. The review teams expressed concern about the complexity of the quantification process and the fact that several computer programs used by the PRA staff for the quantification have not been validated. However, no problems have been found, and the independent systems analysis by LANL has shown reasonable agreement with the SRS PRA. 

---