Hazard-tolerant design

It is rarely possible to completely mitigate a risk other than by somehow taking action to avoid the associated hazard in the first place. Instead, risks need to be reduced so that they become As Low As Reasonably Practical (ALARP). Remedial project actions should be specifically documented — this is sometimes referred to as the Safety Case. Remedial actions may employ hazard avoidance strategies, introduce hazard tolerant design feamres, or apply specihc project management controls, or a combination. Further information on risk management for medical devices can be found in ISO 14971. ... 

The FTA can be used to determine the following minimal cut sets that cause a hazard, probabilities of the hazard and faults. However, when designing such real-time systems like logistic support of operational system performance, the following time parameters delay time between the causes and effect, hazard tolerance time, fault detection time, administrative delay time often have to be analyzed. In standard FTA, the above time parameters are not considered, but can be expressed in Fault Trees with Time Dependencies (FTTD). 

Design guidance on defining hazards/tolerable limits... 

Wherever possible the design of SSCs should be a failure tolerant design. That is, should these items fail, their failure would tend to move the plant towards a safe plant condition. This technique has broader application to areas other than protection against internal hazards, but where vaUd it may help in mitigating the effects of postulated internal hazards. 

Tolerate the Hazard. The design needs to be fault tolerant. That means, in the presence of a hardware/software fault, the software still provides continuous correct execution. Consider hazard conditions to software logic created by equipment wear and tear, or unexpected failures. Consider alternate approaches to minimize risk from hazards that cannot be eliminated. Such approaches include interlocks, redundancy, fail-safe design, system protection, and procedures. 

Aviation fuel (avogas), which is designed for use in piston engines, still contains lead [0.53 mL of tetraethyl lead (TEL) per liter of fuel]. One hazard, tolerable on the ground but deadly in the air, is the vapor lock, and special care is taken to ensure that this does not happen. Hence, automotive fuel, though often equivalent to avogas but half the cost, cannot be used as a substitute. 

For many years the usual procedure in plant design was to identify the hazards, by one of the systematic techniques described later or by waiting until an accident occurred, and then add on protec tive equipment to control future accidents or protect people from their consequences. This protective equipment is often complex and expensive and requires regular testing and maintenance. It often interferes with the smooth operation of the plant and is sometimes bypassed. Gradually the industry came to resize that, whenever possible, one should design user-friendly plants which can withstand human error and equipment failure without serious effects on safety (and output and emciency). When we handle flammable, explosive, toxic, or corrosive materials we can tolerate only very low failure rates, of people and equipment—rates which it may be impossible or impracticable to achieve consistently for long periods of time. 

In general, the safety of a process relies on multiple layers of protection. The first layer of protection is the process design features. Subsequent layers include control systems, interlocks, safety shutdown systems, protective systems, alarms, and emergency response plans. Inherent safety is a part of all layers of protection however, it is especially directed toward process design features. The best approach to prevent accidents is to add process design features to prevent hazardous situations. An inherently safer plant is more tolerant of operator errors and abnormal conditions. 

For a Class I or Class II area, a Division 1 location is likely to contain the hazardous condition during normal operations or frequently because of maintenance and repair. A Division 2 location is likely to contain the hazardous condition only under abnormal circumstances, such as process upset or equipment failure. These two divisions, which are based on the likelihood of an atmosphere being hazardous, control or prescribe the design, construction, and operating features of equipment in that area. Engineering practice tolerates lower levels of protection where there is less likelihood of a hazardous material being present. Thus, Division 1 locations require equipment built to higher standards than equipment built for Division 2 locations. 

Simplify—Design processes and facilities that eliminate unnecessary complexity and that are tolerant of human error. Example Design piping to permit gravity flow of hazardous materials in a plant, eliminating the need for pumps, which can leak. 

Much of what we have learned about the detrimental psychological effects of exposure to chemicals has come from the workplace. One reason is that greater hazards were tolerated in the workplace than in the communal environment. Another is that research protocols could be more specific about the chemicals because they could be identified with designated industrial processes. 

Fig. 2-7. Filling 75-mm artillery shells with mustard agent at Edgewood Arsenal, Md. Facilities designed to fill shells with chemical agents were notoriously hazardous. Anecdotal reports from mustard shell-filling plants indicated that over several months, the entire labor force could be expected to become ill. These workers apparent nonchalance to the hazards of mustard would not be tolerated by the occupational medicine standards of a later era (see Figure 2-31). Photograph Chemical and Biological Defense Command Historical Research and Response Team, Aberdeen Proving Ground, Md.

While a preliminary functional decomposition of the system components is created to start the process, as more information is obtained from the hazard analysis and the system design continues, this decomposition may be altered to optimize fault tolerance and communication requirements. For example, at this point the need... 

Note that the example SIL levels provided in this chapter are only examples. They are not to be assumed recommended levels of protection. The selection of an appropriate Safety Integrity Level (SIL) is site-specific and the analysis requires selecting criteria for tolerable risk, and evaluating process conditions, specific chemicals, equipment design-limits, control schemes, process conditions, and unique hazards. Experts in process engineering, instrumentation, operations, and process safety should imdertake SIL selection. 

Gibson, S.B., 1976. The design of new chemical plant using hazard analysis. Process Industry Hazards, Symposium Series No. 47. 135 (IChemE. Rugby. UK). HSE, 1992, Tolerability of Risk from Nuclear Power Stations, revised edition. Pantony, M.F.. Scilly. N.F. and Barton. J.A.. 1989. Safety of exothermic reactions a UK strategy, Int Symp on Runaway Reactions. 504—524 (CCPS, AIChE. USA). Kauffman, D. and Chen, H-J.. 1990, Fault-dynamic modelling of a phthalic anhydride reactor, J Loss Prev Process hid. 3 386-394. 

---