Subsystem hazard analysis example

In order to utilize the ETBA in the performance of the system safety analyses listed above, certain essential data are required for evaluation. For example, if the ETBA is to be performed on a specific manufacturing facility, then the analysis should begin with an examination of completed facility drawings. If the ETBA is concerned with a specific project, or a newly designed piece of manufacturing equipment, the project plans and schematics must be evaluated. It should be noted that the level of detail required is dependent on the analysis itself. Development of a preliminary hazard list will not require extensive detail and evaluation, whereas an ETBA in support of a subsystem hazard analysis will meticulously analyze the project to the component level and detailed drawings will, therefore, be required. 

A subsystem hazard analysis is performed to identify hazards in the component systems within a larger system. For example, in the... 

Most hazards analyses review a subset of a larger system. For example, a refinery hazards analysis team may carry out a hazards analysis on just the catalytic cracking unit, a pipeline company may analyze just the marine loading operations, or an offshore team may analyze just one platform in a larger complex. Yet these subsystems are part of larger systems, which means that hazards can be transferred to or from the other units across the interfaces. 

The SSHA evaluates hazardous conditions, on the subsystem level, which may affect the safe operation of the entire system. In the performance of the SSHA, it is prudent to examine previous analyses that may have been performed such as the preliminary hazard analysis (PHA) and the failure mode and effect analysis (FMEA). Ideally, the SSHA is conducted during the design phase and/or the production phase, as shown in Chapter 3, Figure 3.4. However, as discussed in the example above, an SSHA can also be done during the operation phase, as required, to assist in the identification of hazardous conditions and the analysis of specific subsystems and/or components. In the event of an actual accident or incident investigation, the completed SSHA can be used to assist in the development of a fault tree analysis by providing data on possible contributing fault factors located at the subsystem or component level. 

This example will develop a hardware FMEA for a proposed system that is well into the design phase of the product life cycle. For informational purposes, it is assumed that a preliminary hazard analysis was previously performed during the early stages of the design phase of this system. The information from the PHA will be used to assist in the development of the hardware FMEA. It should also be noted that the nature of a FMEA requires evaluation of subsystems, subassemblies, and/or components. For this reason, more detailed and specific descriptive information is provided here than that supplied for previous examples discussed in this text. 

Figure 11.1 shows an example of a fault hazard analysis worksheet that can be modified to a specific system or subsystem. An explanation of each column on the worksheet is also provided. 

This analysis section will be followed by a review of possible incidents involving the system and which could become hazardous, for example, due to fire, explosion, or release of toxic materials. In this context energy sources and media should be noted in particular. The system will be subdivided into subsystems which permit definite evaluation of possible hazards. The subsystems to be evaluated must permit ready separation from each other with respect to the set-up and mode of operation, while all reciprocal actions must remain identifiable. 

System Structure Analysis. After the identification of subsystems to be examined and the definition of undcsired events within the context of preliminary hazard analysis, events which lead to incidents are investigated. These event sequences can be represented as logic structure in a block diagram, a flow diagram, a fault tree, or a decision table. In the presentation which follows (Table 4.9.). a decision table was used. It contains, column by column, the combinations of system states which lead to the undesired event. The presentation permits qualitative identification of weak points in the system. In general, for example, the probability of a system state will decline with the growing number of failed components. The logic structure presentation could form the basis for further quantitative analyses. 

Figure 7.4 is the SSHA worksheet, completed to show the analysis of the two conditions discussed in this example. Additional evaluation can occur regarding the elevator system, with concentration on other possible hazardous conditions associated with other elevator subsystems and components. 

---