Functional Hazard Analysis example

An example top-down approach is the functional hazard analysis (FHA). 

Human loudness perception depends in a complex manner on both frequency and the overall loudness of sound. (For example, bass is more difficult to hear in music played at low volume than in the same music played at high volume.) To capture this behavior, two weighting scales have been developed for use in sound hazard analysis. The most common of these is the A weighting scale, which is commonly used to assess occupational and environmental noise. The A scale weights sounds in the 1000-6000 Hz range much more heavily than low-frequency sounds. The A-weighted intensities (dBA) of some common sounds are listed in Table 5. By contrast, the C weighting scale is used for very loud sounds and is a much flatter function of frequency. 

A systems hazards analysis (SHA) is a systematic and comprehensive search for and evaluation of all significant failure modes of facility systems components that can be identified by an experienced team. The hazards assessment often includes failure modes and effects analysis, fault tree analysis, event tree analysis, and hazards and operability studies. Generally, the SHA does not include external factors (e.g., natural disasters) or an integrated assessment of systems interactions. However, the tools of SHA are valuable for examining the causes and the effects of chemical events. They provide the basis for the integrated analysis known as quantitative risk assessment. For an example SHA see the TOCDF Functional Analysis Workbook (U.S. Army, 1993-1995). 

Not all Systran interactions are carried ont by clinical users. Some individuals might be configured as super-users or Systran administrators and have access to functions which influence many aspects of the Systran. The functionality accessible to administrators needs to be included in the hazard analysis to determine whether it has the potential to directly or indirectly impact care. For example, a Systran administrator might undertake a monthly task to suspend system access for those users who have... 

While a preliminary functional decomposition of the system components is created to start the process, as more information is obtained from the hazard analysis and the system design continues, this decomposition may be altered to optimize fault tolerance and communication requirements. For example, at this point the need... 

In the second approach to a What-If analysis, the hazards analysis discussions are organized around equipment types and their function. Examples of equipment type are listed below. 

The first part in the analysis is to identify hazards associated with the operations. First, the facility is separated into different areas according to their function (called functional areas). For example, a ceramic process facility can be separated into shipping and receiving area, ceramic process area, storage area, etc. 

In order to determine the required SIL level, a detailed hazard analysis is performed for the equipment under control (EUC). From the hazard analysis, all safety functions are identified (example—Detect failure of braking). A target safety integrity level is assigned to each of the safety functions (example—detect failure of braking—SIL 3) in order to ensure the residual risk is lower than the acceptable risk (in other words, the risk is sufficiently reduced). The outcome will be an EUC safety function specification detailing the function and target SIL level (between 1 to %) required for each safety function identified in the hazard analysis. 

For this paper we treat hazard assessment as a combination of two interrelated concepts hazard identification, in which the possible hazardous events at the system boundary are discovered, and hazard analysis, in which the likelihood, consequences and severity of the events are determined. The hazard identification process is based on a model of the way in which parts of a system may deviate fi om their intended behaviour. Examples of such analysis include Hazard and Operability Studies (HAZOP, Kletz 1992), Fault Propagation and Transformation Calculus (Wallace 2005), Function Failure Analysis (SAE 1996) and Failure Modes and Effects Analysis (Villemeur 1992). Some analysis approaches start with possible deviations and determine likely undesired outcomes (so-called inductive approaches) while others start with a particular unwanted event and try to determine possible causes (so-called deductive approaches). The overall goal may be safety analysis, to assess the safety of a proposed system (a design, a model or an actual product) or accident analysis, to determine the likely causes of an incident that has occurred. 

The GPCA safety requirements were designed on the basis of a preliminary hazard analysis for the controller of the pump. We found that almost half of the requirements can be related to user interface functionalities, and correctly capture basic human factors concerns. However, a hazard analysis specifically addressing user interface functionalities is needed to cover a more complete set of aspects related to human factors. We are currently starting this hazard analysis. Some examples of safety features and constraints that are currently not considered in the GPCA safety requirements and can potentially make the user interface design safer follows. 

New systems or processes may also need to be qualified from an operational safety perspective. This is particularly relevant in the case of chemical synthesis involving exothermic reactions. Critical safety aspects are usually identified using hazard operability or HAZOP assessments and studies. For example, a HAZOP analysis of an exothermic reaction vessel would involve consideration of the consequence of failure of the motors for mixers or circulation pumps for cooling water. Thus, the qualification of such a system would involve checks and assessment to ensure that the system/process can be operated safely and that pressure relief valves or other emergency measures are adequate and functional. 

General References Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples, American Institute of Chemical Engineers, New York, 1992 Layer of Protection Analysis A Simplified Risk Assessment Approach, American Institute of Chemical Engineers, New York, 2001 ISA TR84.00.02, Safety Instrumented Functions (SIF)—Safety Integrity Level (SIL) Evaluation Techniques, Instrumentation, Systems, and Automation Society, N.C., 2002. 

The extent of accommodation and characterization of uncertainty in exposure assessment must necessarily be balanced against similar considerations with respect to hazard, since the outcome of any risk assessment is a function of comparison of the two. If, for example, there is limited information to inform quantitatively on hazard and, as a result, a need to rely on defaults, there is limited benefit to be gained in developing the exposure analysis such that any increase in certainty is cancelled by uncertainties of greater magnitude associated with quantification of critical hazard, as a basis for a complete risk assessment. 

Additional parameters that are readily incorporated into a stand-alone immune function test such as the KLH-TDAR model include ex vivo lymphocyte proliferation, cytokine protein expression, and immunophenotype analysis any or all of which can enhance hazard identification and characterization of a potential immunotoxicant. While the KLH-TDAR is an example of a combined immune function screen and mechanistic study, the ex vivo methodologies described herein are generally applicable to toxicology studies that do not include an immunization protocol. Moreover, the methodologies are not species-specific however, responsiveness to various stimulants to induce ex vivo lymphocyte proliferation and cytokine production may differ across species and strain, requiring procedural optimization for a given species and ex vivo test. 

Part II of this Basic Guide to System Safety presents and briefly discusses some of the more common system safety analytical tools used in the performance of the system safety function. Through example analyses of hypothetical mechanical and/or electrical systems, the reader should become familiar with each type of system safety analysis method or technique discussed. However, it must be understood that it is not within the limited scope of this volume to provide a detailed explanation of each of these methods and/or techniques. The intention is to merely introduce the reader to the various tools associated with the system safety process. The value of each concept in the analysis of hazard risk will vary according to the individual requirements of a given organization or company. 

Major elements of an occupational safety and health program address recognition, evaluation, and control of hazards. The activities may include risk assessment and charting of probability and severity of potential incidents. The activities may deal with routine functions as well as non-routine functions. Changes in operations and conditions or equipment may also trigger these activities. Inspections, reviews, and other analysis methods will help identify the hazards, the likelihood of occurrence and the potential severity. For example, there should be inspections of repair and maintenance work to ensure that guards and other protections are in place or an area is clear of flammable and combustible materials and sources of heat and fire. Previous chapters offered several methods for hazard recognition and control. 

---