Fault tree analysis limitations

The use of event trees is sometimes limiting for liazard analysis because it may lack die capability of quantifying die potendal of die event occurring. Tlie analysis may also be incomplete if all inidal occurrences are not identified. Its use is beneficial in examining, rather dian evaluating, die possibilities and consequences of a failure. For this reason, a fault tree analysis (FTA) should supplement diis, to establish die probabilities of die event tree branches. Tliis topic was introduced in a subsection of Cliapter 16. 

Figure 21.7.2 demonstrates die preliminary steps for a fault tree analysis (FTA) in addition, die TOP event, bounds, configurations, and unallowed events are specified, and die level of resolution is shown. Once all die limits have been detennined, die fault tree is constructed (Figure 21.7.3). Note tliat every branch of die fault tree ends in a basic fault or cause leading to die TOP event.

This excellent, 44-page Canadian booklet [18] lists 58 references covering, but not limited to Emergency Planning, Process Hazards Reviews, Fault Tree Analysis, Evaluation of Toxic Vapor Cloud Hazards. 

Identification can be as simple as asking what-iP questions at design reviews. It can also involve the use of a checklist outlining the normal process hazards associated with a specific piece of equipment. The major weakness of the latter approach is that items not on the checklist can easily be overlooked. The more formalized hazard-assessment techniques include, but are not limited to, hazard and operability study (HAZOP), fault-tree analysis (FTA), failure mode-and-effect analysis (FMEA), safety indexes, and safety audits. 

Three hazard analysis techniques are currently used widely Fault Tree Analysis, Event Tree Analysis, and HAZOP. Variants that combine aspects of these three techniques, such as Cause-Consequence Analysis (combining top-down fault trees and forward analysis Event Trees) and Bowtie Analysis (combining forward and backward chaining techniques) are also sometimes used. Safeware and other basic textbooks contain more information about these techniques for those unfamiliar with them. FMEA (Failure Modes and Effects Analysis) is sometimes used as a hazard analysis technique, but it is a bottom-up reliability analysis technique and has very limited applicability for safety analysis. 

Fault tree analysis is a complete procedure. If consistently applied it generates all event combinations leading to failure. Limitations do not derive from the procedure but from the knowledge and scrupulousness of the analyst. It goes without saying that phenomena not known at the time of analysis cannot be identified. 

The approach used for the estimation of loss of life in floods shows considerable resemblance to the approach that is used in the Dutch major hazards policy. In both cases, the probability of a critical event (loss of containment or flood) is estimated using fault tree analysis, after which the physical effects associated with that critical event are considered (using e.g. dispersion or flood propagation models) and related to mortality estimates (using dose-response functions or flood mortality functions). But while the potential for evacuation is often limited when it comes to explosions or toxic releases, it could be significant when it comes to floods. 

Fault tree analysis is used primarily as a tool for conducting system or subsystem hazard analyses, even though qualitative or top-level (that is, limited number of tiers or detail) analyses may be used in performing preliminary hazard analyses. Generally, FTA is used to analyze failure of critical items (as determined by a failure mode and effects analysis or other hazard analysis) and other undesirable events capable of producing catastrophic (or otherwise unacceptable) losses. 

The first step in performing a fault tree analysis is to collect the appropriate project description documents, existing hazard analyses, and guidance documents and carefully review them to determine the limits, scope, and ground rules for the FTA.This review includes defining the system to be analyzed, the depth or indenture levels to be included in the effort, and, of course, the nature of the undesired event or failure to be studied. 

Analysis of a fault tree can be no better than the events identified for it. A major limitation of fault tree analysis is failure to identify all the events that may lead to a top event. Failure to include an event may simply be oversight. However, it may also be a lack of experience and knowledge of the system and its behavior or potential behavior. Early in the design and development of a system it is difficult to anticipate failures and undesired events. Team members may not have insight into the possible failures in the future. Team members may have limited knowledge and experience with materials and components that make up a system. 

Another limitation on the use of fault tree analysis is cost. Compiling the knowledge for, constructing the fault tree, and assigning probabilities to tree elements can be laborious and costly. 

Where mass limits are the main defense against criticality, assay and inventory records arc the important control measures. Fault tree analysis shows where the most effective point of application for an assay system is to cover several areas with one system. This is done by tracing the source of an overbatch to the lowest level cause, which often is the same for different areas. For complex facilities with many interacting process areas, fault tree analysis can be a most valuable tool of the safety professional. 

An approach to fault tree analysis. (A) External boundary resolution limit, (B) deductive analysis—FTA. 

Fault tree analysis is highly effective in determining how combinations of events and failmes can cause specific system failures, however, the technique has three main limitations ... 

Fault Tree Analysis employs an analytical tree to display the results of an analysis (Suokas and Rouhiainen, 1993). It starts with the top event (injury or damage). The analysis proceeds backwards in order to identify all events and conditions that have caused the injury or damage. Logical relations (necessary and/or sufficient conditions) are estabhshed. Fault-tree analysis is not an accident model per se and gives limited support in the identification of causal factors. 

A number of analysis techniques such as fault tree analysis, real-time logic and timed petri-nets are being used in limited contexts. However, system wide techniques that allow consideration of the control system rather than just of the software in isolation require further development. 

---