Risk assessment failure analysis

System safety methods also focus on failures of components and complete systems. Of particular interest are those that lead to injury, illness and loss of property, or of the systems. Methods often include risk assessment and analysis. 

Safety analyses principally comprise qualitative Hazard Analysis and probabilistic Safety Risk Assessment. Hazard Analysis models and evaluates the system s hazardous conditions and related system functions in order to identify the possible hazardous consequences which may occur as the result of initiating events such as failures or environmental aggressions. Probabilistic Safety Risk Assessment evaluates the... 

Methods for performing hazard analysis and risk assessment include safety review, checkhsts, Dow Fire and Explosion Index, what-if analysis, hazard and operabihty analysis (HAZOP), failure modes and effects analysis (FMEA), fault tree analysis, and event tree analysis. Other methods are also available, but those given are used most often. 

Risk-Based Inspection. Inspection programs developed using risk analysis methods are becoming increasingly popular (15,16) (see Hazard ANALYSIS AND RISK ASSESSMENT). In this approach, the frequency and type of in-service inspection (IS I) is determined by the probabiUstic risk assessment (PRA) of the inspection results. Here, the results might be a false acceptance of a part that will fail as well as the false rejection of a part that will not fail. Whether a plant or a consumer product, false acceptance of a defective part could lead to catastrophic failure and considerable cost. Also, the false rejection of parts may lead to unjustified, and sometimes exorbitant, costs of operation (2). Risk is defined as follows ... 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

Hazard analysis (HAZAN) is a quantitative way of assessing the likelihood of failure. Other names associated with this technique are risk analysis, quantitative risk assessment (QRA), and probability risk assessment (PRA). Keltz [44] expressed the view that HAZAN is a selective technique while HAZOP can be readily applied to new design and major modification. Some limitations of HAZOP are its inability to detect every weakness in design such as in plant layout, or miss hazards due to leaks on lines that pass through or close to a unit but cany material that is not used on that unit. In any case, hazards should... 

A risk assessment analyses systems at two levels. The first level defines the functions the system must perform to respond successfully to an accident. The second level identifies the hardware for the systems use. The hardware identification (in the top event statement) describes minimum system operability and system boundaries (interfaces). Experience shows that the interfaces between a frontline system and its support systems are important to the system cs aluaiion and require a formal search to document the interactions. Such is facilitated by a failure modes and effect analysis (FMEA). Table S.4.4-2 is an example of an interaction FMEA for the interlace and support requirements for system operation. 

The other main application area for predictive error analysis is in chemical process quantitative risk assessment (CPQRA) as a means of identifying human errors with significant risk consequences. In most cases, the generation of error modes in CPQRA is a somewhat unsystematic process, since it only considers errors that involve the failure to perform some pre-specified function, usually in an emergency (e.g., responding to an alarm within a time interval). The fact that errors of commission can arise as a result of diagnostic failures, or that poor interface design or procedures can also induce errors is rarely considered as part of CPQRA. However, this may be due to the fact that HEA techniques are not widely known in the chemical industry. The application of error analysis in CPQRA will be discussed further in Chapter 5. 

From a human reliability perspective, a number of interesting points arise from this example. A simple calculation shows that the frequency of a major release (3.2 x lO"" per year) is dominated by human errors. The major contribution to this frequency is the frequency of a spill during truck unloading (3 X10" per year). An examination of the fault tree for this event shows that this frequency is dominated by event B15 Insufficient volume in tank to imload truck, and B16 Failure of, or ignoring LIA-1. Of these events, B15 could be due to a prior human error, and B16 would be a combination of instrument failure and human error. (Note however, that we are not necessarily assigning the causes of the errors solely to the operator. The role of management influences on error will be discussed later.) Apart from the dominant sequence discussed above, human-caused failures are likely to occur throughout the fault tree. It is usually the case that human error dominates a risk assessment, if it is properly considered in the analysis. This is illustrated in Bellamy et al. (1986) with an example from the analysis of an offshore lifeboat system. 

The PHA procedure can be conducted using various methodologies. For example, the checklist analysis discussed earlier is an effective methodology. In addition, Pareto analysis, relative ranking, pre-removal risk assessment (PRRA), change analysis, failure mode and effects analysis (FMEA), fault tree analysis, event tree analysis, event and CF charting, PrHA, what-if analysis, and HAZOP can be used in conducting the PHA. 

From those techniques given in Table 1 my personal preference is for failure mode, effects, and criticality analysis (FMECA). This technique can be applied to both equipment and facilities and can be used to methodically break down the analysis of a complex process into a series of manageable steps. It is a powerful tool for summarizing the important modes of failure, the factors that may cause these failures, and their likely effects. It also incorporates the degree of severity of the consequences, their respective probabilities of occurrence, and their detectability. It must be stressed, however, that the outcome of the risk assessment process should be independent of the tool used and must be able to address all of the risks associated with the instrument that is being assessed. 

Fault tree analysis is based on a graphical, logical description of the failure mechanisms of a system. Before construction of a fault tree can begin, a specific definition of the top event is required for example the release of propylene from a refrigeration system. A detailed understanding of the operation of the system, its component parts, and the role of operators and possible human errors is required. Refer to Guidelines for Hazard Evaluation (CCPS, 1992) and Guidelines for Chemical Process Quantitative Risk Assessment (CCPS, 2000). 

Risk assessment tools such as a nine-block risk assessment (Table 9) or a failure mode and effect analysis (FMEA) are available to assist the process owner with the evaluation of the process or issue to better understand and communicate the... 

Metal Emission Limits. Limits for metals, both carcinogenic and noncarcinogenic, are based on an adjusted stack height. Failure to meet these limits requires risk assessments using site specific factors and modeling to establish limits for each metal. The assessments are based on the probability of developing adverse health effects or cancer, based on an inhalation exposure pathway to maximum exposed individuals located near the incinerator (see Hazard ANALYSIS AND RISKASSESSL nt). 

FMEA is a quantitative risk analysis for complex systems (Fig. 6). As this approach involves assessment of occurrence probabilities, detection of failures, and judgment as to the severity of a failure, it should only be chosen if some practical experience with the technical system is available. Each of the three values will be assigned a number from 1 to 5. Multiplying these values results in the risk priority number. This number indicates the priority of the assessed failure. The pure version of the FMEA is seldom practiced in the pharmaceutical industry. 

Second, guaranteeing availability as high as 99-9999 percent requires a tremendous amount of performance data on every single piece of equipment. Accurate risk-assessment analysis requires reliable data such as mean time between failure (how long a component is likely to run before breaking down) and mean time to repair (how long it will take to fix a component that has broken down). Analysts would prefer to have as much as i million hours of data on each and every system component. That takes years to... 

The risk assessment process can be conducted by examining record types to see if they are GxP or non-GxP, and then applying severity checks, likelihood, and probability of detection criteria, as illustrated in Figure 15.2. The most severe scenarios shonld be linked to direct patient/consnmer impact. GxP noncompliance and broken license conditions are severe in their own right bnt not as critical as patient/consumer health in this analysis." Its likelihood will be influenced by the degree of human error in how the record is input and used. The probability of detection needs to take into account the probability of the impacted record being used. Once failure modes are understood, then the appropriate design controls can be introduced. These should be documented and validated as part of the computer system life cycle discussed earher in this book. 

May 1996 FDA 483 Failure to identify and analyze the system/software critical functions. No documented risk assessment and hazard analysis was done. .. ... 

A systems hazards analysis (SHA) is a systematic and comprehensive search for and evaluation of all significant failure modes of facility systems components that can be identified by an experienced team. The hazards assessment often includes failure modes and effects analysis, fault tree analysis, event tree analysis, and hazards and operability studies. Generally, the SHA does not include external factors (e.g., natural disasters) or an integrated assessment of systems interactions. However, the tools of SHA are valuable for examining the causes and the effects of chemical events. They provide the basis for the integrated analysis known as quantitative risk assessment. For an example SHA see the TOCDF Functional Analysis Workbook (U.S. Army, 1993-1995). 

A quantitative risk assessment (QRA) is an integrated, quantitative analysis (including uncertainty) of accident scenarios, their likelihood, and possible consequences. Current QRAs examine human actions as well as systems failures, external events as well as internal failures, and worker risk as well as public risk. A salient feature of a QRA is that it is integrated, in that it ... 

---