Safety analysis, process components

Does Visualization Speed up the Safety Analysis Process This paper reports on an experiment that shows the benefits of using visual tool support for component fault analysis. 

Identifying the contribution of any COTS component to the system requires analysis. Figure 3 illustrates the safety analysis process that was developed during the study, designed to support the integration of software COTS components to the Hawk mission computer. The identified process consists of the following steps ... 

Furthermore, once every process component has been analyzed separately for worst case, stand-alone conditions, there is no additional safety risk created by joining the components into a system. That is, if every process component is fully protected based on its FMEA analysis, a y tern made up of several of these components will also be fully protected,... 

The modified FMEA approach has been used by the API to develop RP14C. In this document ten different process components have been analyzed and a Safety Analysis Table (SAT) has been developed for each component. A sample SAT for a pressure vessel is shown in Table 14-4. The fact that Tables 14-3 and 14-4 are not identical is due to both the subjective natures of a Hazard Analysis and FMEA, and to the fact that RP14C is a consensus standard. However, although the rationale differs somewhat, the devices required are identical. (The gas make-up system in Table 14-4 is not really required by RP14C, as we shall see.)... 

The RP 14C also provides standard reasons allowing the elimination of certain devices when the process component is considered as part of an overall system. Figure 14-3 shows the Safety Analysis Checklist (SAC) for a pressure vessel. Each safety device is identified by the SAT (with the exception of gas make-up system ) is listed. It must either be installed or it can be eliminated if one of the reasons listed is valid. 

FMEA is focused on safety consequences of component failures. Identified failure modes of a component are analyzed case by case. The analysis process results in an explicit and documented decisions that take into account the risk associated with a given failure mode. The decision can be just the acceptance (supported by a convincing justification) of the consequences of the failure or it can suggest necessary design changes to remove (or mitigate) the consequences or causes of the failures. Documentation is an important output of FMEA. This documentation can be then referred to by a safety case for the considered system. 

Thorough and effective analyses of workplace incidents are critical components of a comprehensive safety management system. Yet, many incident analysis processes (i.e., accident investigations) fall short. They frequently fail to identify and resolve the real root causes of injuries, process incidents and near misses. Because the true root causes of incidents are within the system, the system must change to prevent the incident from happening again. 

Exposure to Hazardous Chemicals in Laboratories, or Laboratory Standard ], and various substance specific standards in Subpaits Z of 29 CFR 1910 and 29 CFR 1926. EPA also has requirements for performing hazard analyses, such as the Chemical Process Safety Standards (40 CFR 68.67). In addition. Section 313, Emergency Planning and Community Right-to-Know Act (EPCRA) contain hazard assessment requirements. Many of the hazard assessment components of these standards crosscut one another. Therefore, managers should evaluate and describe the relationship of these requirements to assure a coordinated approach which will greatly facilitate the hazard analysis process. 

When the system changes, the environment in which the system operates changes, or components are reused in a different system, a new or updated safety analysis is required. Intent specifications can make that process feasible and practical. 

Safety Class SSCs - Systems, Structures or Components including primary environmental monitors and portions of process systems, whose failure could adversely affect the environment, or safety and health of the public as identified by safety analysis. 

DOE Order 5480.23, Chg. I, Nuclear Safety Analysis Reports, Paragraph 8.b.(3)(d), as amplified in paragraph 4.f.(3)(d)4 of Attachment 1 to the Order, requires a description of the facility and operations conducted in the facility, including design of principal structures, components, systems, engineered safety features, and processes. (DOE 1994a). 

In accordance with DOE-STD-3009-94, (DOE 1994) safety SSCs are divided Into two categories (1) safety-class and (2) safety-significant. DOE-STD-3009-94 defines safety-class SSCs (SCSSCs) as those SSCs, including environmental monitors and portions of process systems, whose failure could adversely affect the environment or safety and health of the public as identified by safety analysis. The phrase adversely affect refers to exceeding offsite EGs (i.e., a whole-body dose of 25 rem to the nearest located member of the public). SCSSCs are systems, structures, or components whose preventive or mitigative function is necessary to keep hazardous material exposure to the public below the EGs. 

Critical items List The purpose of the FMEA is to identify and evaluate failure modes and the possible system effects of those failures. Since the potential for undesirable effects must be eliminated or controlled, the FMEA also provides recommended actions that must be taken to accomplish this goal. As part of this analysis process, the FMEA identifies any and all items within the system that, if a failure were to occur, would have a critical effect on the operation of that system. Therefore, to facilitate evaluation and analysis of these system effects, a critical items list is developed. The list provides detailed descriptive information on each item. It will explain its overall function within the system, as well as the function of any components that may make up that item. The failure mode determined as critical is then listed along with the potential effect(s) of such a failure. If an item on the critical items list is to be accepted as is, then acceptance rationale must be provided. Such rationale may include an explanation of any existing or planned design limitations that will prevent the failure during actual system operations, or the provision of excessive factors of safety that will render such fail-ure(s) extremely improbable. Another area for evaluating acceptance is the history, or lack thereof, and any known failures of systems similar in nature and operation. 

The latest safety documentation update for K-Reactor in Cold Standby is discussed in Section 4.0 of this BIO and-consists primarily of the K-Reactor Safety Analysis Report ef 3-5), the K-Reactor Technical Specifications (Ref. 3-6), and the K-Reactor Cold Standby Plan O f. 3-3). These documents provide for storage and handling of unirradiated fuel and irradiated components and storage and processing of contaminated moderator. The latest safety documentation for L-and F-Reactor Disassembly Basins is also discussed in Section 4.0 of this BIO. These documents consist mainly of the L- and P-Reactor T hnical Specifications, L-Reactor Cold Shutdown Plan, P-Area Standby Plan, and the Transfer Packages for 100-L and P Area Facilities. These documents provide for storage and handling of irradiated components. 

Gathering and analyzing accident/incident data is not the company s entire safety and health program, but a single element. Data provides feedback and evaluative information as companies proceed toward accomplishing their safety and health goals thus, data contributes an important component in the analysis process. 

Within the overall aim it is the task of quantitative safety analysis to ascertain the frequency or occurrence probability of undesired events leading to incidents. Safety analysis will, in the case of problematic results of qualitative analysis, necessarily inspire the question of whether it should be continued in quantitative form. The question arises in particular when new technical equipment and processes are used. Quantitative safety analysis starts with knowledge of the logic structure of the system to be examined, as has already been ascertained in the course of qualitative analysis. A condition for execution is the presence of sufficient data—information about the behavior of the individual system components and parts. The information must be arranged in such a way that reliability characteristics (failure probabilities, failure rates) and maintenance characteristics (rates of repairs) can be derived. It is only when it is certain that sufficient data are available that quantitative analysis is possible. 

Create a Safety Analysis Function Evaluation (SAFE) Chart. This is a chart showing all process components and their required safety devices. 

P ID is another important information source for process safety analysis. For a modem chemical process, P ID is normally very complex and it is a tedious process to recreate such a drawing in PHASuite. These days, most of the P ID drawings are in some electronic format, such as AutoCAD , SmartPlant P ID etc. The drawings created using older version of CAD tools are composed of lines or curves. In recent years, with the development of object oriented programming, newer CAD tools are object-based and the basic drawing components are blocks instead of lines, and some of them are... 

The functional FMEA is used to evaluate failures in one or many subsystems that function within a larger system, while the hardware FMEA examines failures in the assemblies, subassemblies, and components within those subsystems. The FMEA, therefore, has great versatility in the system safety process. The analysis can either be specialized, without regard for other subsystems which are not within the scope of the analysis, or it can be generalized to encompass total subsystem or system effects of a given failure condition. However, because the FMEA does not consider the human factors element or multiple failure analyses within a system, other types of system safety analysis tools and techniques should also be utilized. 

In addition to a formal specification, we need a technique to analyze the fault tolerance behavior of a component in a formal way. Approaches such as [19] verify formalized fault trees against formal implementation models. Furthe-more, several fault injection analyzes that rely on model checking like [3] and [9] have been presented. In this paper we focus on a fault injection based-technique [16], [10] that is called model-based safety analysis MBS A. The MBS A processes functional requirements and provides complete results as cut-sets and allows to define custom faulty behavior in the implementation model, which is specified using Matlab/Statefiow. Cut-sets are unique combinations of malfunctions occurrences that can cause a system failure. A cut-set is said to be minimal if no event can be removed from the set and the combination of malfunctions still leads to a failure[ll]. 

The cross-domain assurance process for safety-relevant software in embedded systems, outlined in this paper, aims to be applied in various different application domains. Thus, supporting the cost-efficient system development as well as the reuse of techniques and tools for the safety analysis. However, not all of the process steps can be realized in a generic and domain-independent way. But our approach is independent from concrete development methodologies and can be applied along with component-based and model-based design. Moreover, common safety analysis techniques can by applied in most process steps. 

The results of the safety analysis of the reactor, including the effects of anticipated process disturbances and postulated component failures and human errors (postulated initiating events) and their consequences, shall be reflected in the SAR to evaluate the capabihty of the reactor to control or to accommodate such situations and failures. 

Figure 3 shows the system with the encapsulation of the components Processing 1 and Processing 2 into one component Processing 7/2. As we can see in the CFT model for this encapsulated architecture, all connections between the ports of the model are straightforward and do not form loops. So, it is impossible to erroneously model loops in the safety analysis model even if the components and their component fault trees are modeled by different teams. The DSM can help to identify such loops in the architecture and to identify the corresponding components to be encapsulated for safety analysis. 

---