Safety Scenarios Component

The scenario component is capable to store pre-defined scenarios and to maintain them (with efficient algorithms in a minimum time) subject to any change in the process. Also, the scenario component is capable to cope with the real time process operations to reflect up-to-date status of the plant and to develop different scenarios for any desired path. ETA (Event Tree Analysis) (CCPS, 1993) is proposed to develop the different scenarios for D1 and D2 algorithms, while FTA (CCPS, 1993) is used to develop the scenarios for 01 and 02. The major difference between the FTA and the ETA is that FTA focuses only on the components faults starting from the top event (major component or process) then goes into sequence of possible faults till it reaches the 

Usually the HAZOP study is used to generate the top events for the analysis tree especially in the initial plant design stage. In order to construct the FTA for the possible fault scenarios the plant structural class model has been constructed, which explains the inheritance from the top structural element (metaclass) Plant Structural Entity up to the smallest physical structural components (i.e. valve), indicating the association of the possible failures or faults with each model element, as shown in figure 3-14. 

BR400--Main 50,000 Lb/Hi OPERATING BR430 CondemaieReiuinPuniip-Ceniiilusal lClC 

The plant equipments (physical components) are organized hierarchically on the basis of the system or equipment type (views) as in 

1 DetdfAon Healh pLiniMbilp nMcttvHy flabng Railing Flaih —T 1 a 

---

The defined safety scenario we used in our study describes one of the possible situations where the RAVON [16] robot can hit other solid objects. The assumption of this scenario is that RAVON moves forward in a moderate drive mode. Moreover, there is no water on the road nor are there any unexpected slopes or gradients. The components of this possible hazard comprise 48 compound components in the RAVON structure, with 70 basic events that can appear in different locations of the OFT model simultaneously. However, due to the test constraints, we decided to include only part of the scenario. The scenario we used in our test consisted of 25 components with more than 33 basic events. We designed the tasks based on a common process to analyze fault trees [17]. The test consisted of four main tasks for both tools ... 

Safety-related components will resist seismic loads under the reference site design. Initiating events for accident scenarios in the area include the crash of military aircraft at the site. 

The DfE partnership will develop information to improve the understanding of the environmental and human health impacts of new and current materials that can be used to meet the fire safety requirements for circuit boards. Project partners include electronics manufacturers, component and board manufacturers, chemical companies, trade associations, environmental groups, universities and governments. The project will consider environmental and human health impacts that can occur throughout the life cycle of a material, from development and manufacture, through product use and end of life of the material or product. Stakeholders have expressed a particular interest in understanding the combustion products that could be formed during certain end of life scenarios. The list of active partners includes ... 

If the verification confirms that the analyzed failure mode has no negative effects on system safety, the failure mode can be accepted. In the opposite case however we know that the failure mode, if actually occurs, can affect the system safety properties. In such case FDR can provide example event scenarios that lead to a contradiction of safety. Those scenarios can then be very helpful while considering possible redesign of the component objects. The results of the failure mode injection campaign are collected in the OF-FMEA tables (see Table 1). 

In addition to the factors shown in figure 8.6, the analysis must consider the impact of having two controllers of the same component whenever this occurs in the system safety control structure. In the friendly fire example in chapter 5, for example, confusion existed between the two AWACS operators responsible for tracking aircraft inside and outside of the no-fly-zone about who was responsible for aircraft in the boundary area between the two. The FMIS example below contains such a scenario. An analysis must be made to determine that no path to a hazard exists because of coordination problems. 

Using the augmented control structure, the remaining activities in STPA are to identify potentially hazardous control actions by each of the system components that could violate the safety constraints, determine the causal factors that could lead to these hazardous control actions, and prevent or control them in the system design. The process thus involves a top-down identification of scenarios in which the safety... 

Good outcome ascertainment is an important component to a meta-analysis in the regulatory context. In the best-case scenario, the meta-analysis is conceived and designed prior to or in conjunction to the design of the trials to be included in the meta-analysis. In this case, the safety outcome can be collected prospectively and actively and if necessary can be adjudicated. By prospectively and actively collecting fhe outcome, ascertainment procedures can be designed to reduce misclassification and bias between the treatment arms of fhe frials. 

---