Functional hazard analysis severity

Model Based Safety Assessment aims at supporting the Preliminary System Safety Assessment (PSSA) [8]. Before the PSSA is performed, the Functional Hazard Analysis identifies the Failure Conditions (e.g. safety critical situations of the system) and assesses their severity on a scale going from No Safety Effect (NSE) to Catastrophic (CAT). Then, during the Preliminary System Safety Assessment, safety models (or alternatively fault-trees) axe built and analysed. A safety model describes formally in which node a fault occurs and how this fault propagates inside the system architecture in order to cause a Failure Condition. 

Presented system consists of several modules, each connected with different aspect of functional safety analysis. There is a hazard identification and analysis module, which generates the risk scenarios and descriptions of safety-related functions. Next module is risk analysis and assessment, which allow determining required SIL for each safety function. The last... 

Hazard analysis The functions, steps, and criteria for design and plan of work, which identify hazards, provide measures to reduce the probability and severity potentials, identify residual risks, and provide alternative methods of further control (SSDC) a process of examining a system, design, or operation to discover inherent hazards, characterizing them as to level of risk and identifying risk-reduction alternatives (APR 800-16) the determination of potential sources of danger and recommended resolutions in a timely manner for those conditions found in either the hardware/software systems, the person-machine relationship, or both, which cause loss of personnel capability, loss of system, or loss of life or injury to the public (NSTS 22254). 

Software System Hazard Analysis This type of analysis is conducted similar to a hardware system hazard analysis (SHA), analyzing software functional processing steps to determine whether they may have any particular hazardous effect on the system. The analysis utilizes a hazard-risk index to illustrate the severity of each potential failure. The main advantage to this method is in its ability to positively identify safety-critical hardware and software functions as well as consider the effect of the human element in system software operations. The results of the software SHA, which identifies single-point failures or errors within a system, can often be used to assist in the development of a software fault tree analysis or, to some degree, a system FMEA. However, as with the other various SWHA techniques briefly described above, this method is also time-consuming and costly to perform. 

A conprehensive product release process ensures that products are very mamre when released. Parallel to the comprehensive quality management process the safety process starts with general safety requirements which are checked for applicability and allocated to the project respectively. It continues with several tasks like performance of an Functional Hazard Assessment, production of an hardware RAM Modelling and Prediction Report and a Failure Modes, Effects and Criticality Analysis for a typical configuration and the use of the previously mentioned hazard checklist. Finally all issues of the product release checklist are to be fulfilled to get the official release. 

For this paper we treat hazard assessment as a combination of two interrelated concepts hazard identification, in which the possible hazardous events at the system boundary are discovered, and hazard analysis, in which the likelihood, consequences and severity of the events are determined. The hazard identification process is based on a model of the way in which parts of a system may deviate fi om their intended behaviour. Examples of such analysis include Hazard and Operability Studies (HAZOP, Kletz 1992), Fault Propagation and Transformation Calculus (Wallace 2005), Function Failure Analysis (SAE 1996) and Failure Modes and Effects Analysis (Villemeur 1992). Some analysis approaches start with possible deviations and determine likely undesired outcomes (so-called inductive approaches) while others start with a particular unwanted event and try to determine possible causes (so-called deductive approaches). The overall goal may be safety analysis, to assess the safety of a proposed system (a design, a model or an actual product) or accident analysis, to determine the likely causes of an incident that has occurred. 

Again, a PHL is developed (use Appendix C as a starting point). The PHL is divided into hazard categories. The functional tree is created. Then the actual facility hazard analysis is started. Each hazard is assigned a severity and probability level, and the other portions of the hazard analysis worksheet are completed. Then a system safety assessment is performed and the worksheet results are analyzed. 

The probability of exposure (E) is a factor used for the ASIL ascertainment. Just like the factor controllability those two factors reduce the severity impact (S). This only applies for functions, which are part of the observed vehicle system (ITEM). The first analysis is necessary in order to identify possible malfunctions of the vehicle system related to the intended function. In order to do this the a functional concept based on new functions and the existing functions need to be structured or an hierarchical architecture need to be developed as part of the ITEM Definition , which is inherent precondition for correct Hazard Analysis and Risk Assessment. 

These functions are the basis for the Functional Hazard Assessment (FHA), for the identification of possible hazards. In workshops with experts - to combine technical, domain and safety know-how - various techniques are applied. This includes brainstorming, use of historical data and functional failure modes and effects analysis to identrfy possible failure modes, their operational effects and the respective severity of the worst credible outcome. Based on the safety-relevant failure modes, potential hazards are determined and respective risks are allocated according to the risk matrix. The FHA leads to derivation of top level hazards. 

As a consequence, since the work of Bufe et al. (1977), a suite of models able to account for earthquake interaction and clustering has been introduced. We have presented those most used in practical applications such as Weibull, gamma, and lognormal and described their main features and differences in terms of their probability density functions and hazard functions. In addition we described a more physical model, that is, the Brownian passage time, which is currently used to perform time-dependent seismic hazard analysis in several areas, tectonic and volcanic areas such as California and Italy. 

Although organophosphates now predominate as high-use Insecticides, a variety of chemicals of other functional types are used to control pests as herbicides, insecticides, fungicides, fumigants, defoliants etc. Several of these are the source of potential operational hazards that must be addressed In terms of worker protection and the necessity for analysis of exposure and assessment of its effects. 

To determine the SIL that should be achieved by components that realize safety functions the lEC 61508 provides several systematic approaches, e.g. risk graph, risk map and quantitative probabilistic analysis. In the case of the risk graph out of the following parameters of hazardous events the SIL can be determined consequence, fi equency and exposure time, possibility of avoiding hazard and probability of unwanted occurrence. 

Major elements of an occupational safety and health program address recognition, evaluation, and control of hazards. The activities may include risk assessment and charting of probability and severity of potential incidents. The activities may deal with routine functions as well as non-routine functions. Changes in operations and conditions or equipment may also trigger these activities. Inspections, reviews, and other analysis methods will help identify the hazards, the likelihood of occurrence and the potential severity. For example, there should be inspections of repair and maintenance work to ensure that guards and other protections are in place or an area is clear of flammable and combustible materials and sources of heat and fire. Previous chapters offered several methods for hazard recognition and control. 

Because of the complexity of chemical processes, the response selection should be tailored to the characteristics and requirements of each plant and safety function. A hazard and risk analysis defines for each hazard scenario when action should be taken, giving the initiating causes, consequence severity, and protection layers. The potential for common cause should also be evaluated to ensure the actions can be implemented in the presence of the initiating cause and the SIF device fault. 

Layer of protection analysis (LOPA) LOPA is a systematic and structured way of quantification of risk reduction and safety integrity level (SIL) determination. Usually, it starts its work on the data developed in HAZOP analysis. For each documented undesired event with an initiating cause, it provides an independent protection layer (IPL), which will mitigate or prevent the hazard. Then, the total amount of risk can be determined. If safety instrumented function is necessary, LOPA methodology can be used to determine SIL also. From ISA 84 transaction it is found that LOPA is a simplified risk assignment tool used to evaluate the effectiveness of IPLs that are designed to reduce the likelihood or severity of an undesirable event. Quantitative PHA LOPA deals with single cause consequence pairs. Detailed documentation is possible and can be applied for continuous process. 

---