Probability Of Failure On Demand Research Articles

PFD analysis of LNG fuel gas supply system for improving combined-cycle power plant safety

In order to determine an unavailability of each safety function subsystem that influences on an overall unavailability of entire protection system for safety analysis and enhancement, a modeling is required. This article presents a safety system modeling to evaluate the detected–undetected failures and repairable behaviors of each safety function subsystem in the studied fuel gas supply system (FGSS), which is utilized in a combined-cycle power plant. The proposed modeling deals with probability of failure on demand (PFD) analysis for calculation of the unavailability of three safety function subsystems, which are gas analytical subsystem (GAS), fuel gas controller subsystem (FGC), and shutdown valve subsystem (SDV). The interested GAS includes two different groups of gas analyzers in 2-out-of-2 (2oo2) voting scheme, when using three gas analyzers in each group in 2-out-of-3 and diagnosis (2oo3D) voting scheme. The interested FGC consists of two controllers in 2oo2 voting scheme, when the structure of each controller is in 1-out-of-1 and diagnosis (1oo1D) voting scheme. The interested SDV consists of two shutdown valves, which are installed in 1-out-of-2 (1oo2) voting scheme. The reliability block diagram is utilized for representative of combination of all three safety function subsystems, and the fault tree is utilized for calculation of PFD unavailability of each safety function subsystem. As the results obtained from the proposed safety function modeling, the influence of three safety function subsystems on the total unavailability of the FGSS is described. In addition, an example of the proposed modeling application to provide two guidelines for effective engineering design and operation is also presented. The first is a guideline to implement an effective human machine interface (HMI) at an operator workstation for real-time monitoring of the studied FGSS in the presence of failures that can be automatically detected by device diagnosis. The latter is a guideline to maintain and troubleshoot the failures that can be revealed by proof test. Based on diagnostic information and proof test results, operation and maintenance savings can be achieved.

SIL‐3, SIL‐2, and unicorns (there is a high probability your SIL 2 and SIL 3 SIFs have no better performance than SIL 1)

AbstractSafety instrumented system (SIS) standards improved the definition of interlocks and introduced requirements for improved management systems to enforce independence from other independent protection layers (IPLs). SIS standards require verification that the performance of each safety instrumented function (SIF) will be met during its lifetime, where the performance criterion is documented as the target safety integrity level (SIL) or risk reduction factor for the SIF. The SIL is in turn tied to specific values of probability of failure on demand (PFD). The current SIS standards and the TR (Technical Reports, from ISA) that explain how to do SIL verification calculations do not include accounting for specific human error probabilities—this is a major deficiency as even the probability of a single human error can be much larger than the target PFD of 0.001 for a SIL 3 and oftentimes a little larger than the PFD of 0.01 for a SIL 2. The SIL verification methods outlined in the standards and technical reports like ANSI/ISA TR84.00.02 facilitate consistency for the component‐only failure rates. As user companies seek to obtain greater risk reduction from their SIS to satisfy their corporate risk criteria, failure to adequately address potential specific human failures can lead to overly optimistic results and a misallocation of resources intended to reduce risk.

“Is your SIF trying to do too much?”

AbstractThe number of inputs and outputs to a SIF (safety instrumented function)—including voting—affects the probability of failure on demand (PFD) and the SIL (safety integrity level), assuming the test interval remains the same. The larger the number of inputs and outputs that perform separate functions, the higher the PFD and potentially the lower the SIL. What if the SIF includes all the sensors and final elements that are involved in any trip of a large processing unit like a heater, a reformer, or a distillation column? What if the SIF includes actions to shut down upstream and downstream units? When SIL verification is done for such a SIF, the target PFD and SIL may not be possible to achieve. The temptation may be to add redundancy in sensors and final elements or to reduce the proof test interval in an attempt to reduce the calculated PFD. Frustration may abound as capital and operating costs rise steeply. This paper shows how to use the principles of layer of protection analysis and the information in the process hazard analysis to split up the massive SIF into smaller SIFs that are more manageable. An example is included.

Dynamic Modeling of Reactor Protection System in Nuclear Power Plant for Reliability Evaluation Based on State Transition Diagram

Reliability assessment of a digital dynamic system using traditional Fault Tree Analysis (FTA) is difficult. This paper addresses the dynamic modeling of safety-critical complex systems such as the digital Reactor Protection System (RPS) in Nuclear Power Plants (NPPs). The digital RPS is a safety system utilized in the NPPs for safe operation and shut-down of the reactor in emergency events. A quantitative evaluation reliability analysis for the digital RPS with 2-out-of-4 architecture using the state transition diagram is presented in this paper. The study assesses the effects of independent hardware failures, Common Cause Failures (CCFs), and software failures on the failure of the RPS through calculating Probability of Failure on Demand (PFD). The results prove the validity of the proposed method in analyzing and evaluating reliability of the digital RPS and also show that the CCFs and longer detection time are the main contributions to the PFD of digital RPS.

Two full capacity generators—Why is the calculated emergency power system probability of failure on demand so high?

AbstractThe probability of failure on demand (PFD) for an emergency generator system is important when electrical power is needed to protect humans from harm or to prevent equipment damage. To evaluate the PFD for an emergency power system (EPS), we must consider: All the components for the fuel, the controls, the transfer switches, and the circuit breakers in the emergency load feeders. The capability of the weekly, monthly, semiannual, annual, and four‐year inspections and proof tests to detect all the failure modes that can prevent correct operation of the generator system. Many common cause events may prevent both generators from starting or running: The fuel storage system. The generator control system including over‐voltage and overload protection. The downstream electrical system including the transfer switches and circuit breakers. Human action during maintenance and testing, such as leaving the transfer switches in test mode instead of automatic. While the EPS may be designed and operated according to NFPA 110, it is critical to evaluate and eliminate single points of failure. The paper will suggest opportunities to provide redundancy, to manage human error, and to improve inspections and proof testing to detect more failure modes.

Application of Hazop, Lopa and Sil to an Alkylation Unit in a Refinery: a Case Study

In a refinery, an alkylation unit is a process for producing gasoline range material (alkylate) from olefins such as propylene, isobutene, butylene, and pentene. In the alkylation process, light hydrocarbons from the Fluid Catalytic Cracking Unit (FCC) react in presence of a catalyst (hydrofluoric acid or sulphuric acid), to form a mixture of heavier hydrocarbons. After the reaction, the alkylate meets the specification as high octane gasoline. Important safety considerations in this process are related to the catalyst. For example, if hydrofluoric acid (HF) is used, its high vapour pressure, making it easily vaporized if a leak occurs in the units. HF can travel a significant distance as a dense vapour. Even though a small concentration of HF is used in the reaction, it is still enough to cause human and environmental problems, since it is a very corrosive and toxic inorganic acid. The objective of this study was to evaluate the hazards in the alkylation unit at a refinery located in Latin America, applying HAZOP, LOPA, and SIL methodologies. This study is based on the assumption that the process operates according to the conditions intended in its design, thus the risk and operability problems are unlikely to occur. The HAZOP (Hazard and Operability Study) analysis covered 13 sections of the alkylation process. Hazardous scenarios were categorized as: related to safety, environmental, and financial; each topic was also risk ranked to assess the strength of existing safeguards. The causes of hazardous scenarios were identified including human error, equipment failure, and external events. The severity of deviations was evaluated without any protection or safeguards. From all the deviations that were analysed, 24 scenarios were identified as significant risk and of high risk. These scenarios were then analysed by LOPA (Layer of Protection analysis) and SIL (Safety Integrity Level) methodologies, to identify the layers of protection that mitigate the hazardous scenarios found in the HAZOP analysis, as well as assigning a PFD (probability of failure on demand) value on each safeguard. Based on this, recommendations are provided, to mitigate the consequences or improve the operational capab

Dynamic Modeling of Reactor Protection System in Nuclear Power Plant for Reliability Evaluation Based on State Transition Diagram

Reliability assessment of a digital dynamic system using traditional Fault Tree Analysis (FTA) is difficult. This paper addresses the dynamic modeling of safety-critical complex systems such as the digital Reactor Protection System (RPS) in Nuclear Power Plants (NPPs). The digital RPS is a safety system utilized in the NPPs for safe operation and shut-down of the reactor in emergency events. A quantitative evaluation reliability analysis for the digital RPS with 2-out-of-4 architecture using the state transition diagram is presented in this paper. The study assesses the effects of independent hardware failures, Common Cause Failures (CCFs), and software failures on the failure of the RPS through calculating Probability of Failure on Demand (PFD). The results prove the validity of the proposed method in analyzing and evaluating reliability of the digital RPS and also show that the CCFs and longer detection time are the main contributions to the PFD of digital RPS.

Quantitative software reliability assessment methodology based on Bayesian belief networks and statistical testing for safety-critical software

This study proposes an overall methodology that provides in-depth evidence on software reliability. It is used to quantitatively assess the reliability of nuclear power plant (NPP) safety-critical software for the incorporation of digital instrumentation and control systems into NPP probabilistic risk assessment (PRA). The methodology consists of three parts: (1) the relationships among the software development life cycle (SDLC) phases, the number of remaining faults in the software, and the probability of failure on demand (PFD) are modeled by a Bayesian belief network, which can provide a prior distribution of the software PFD; (2) a reliability model for the PFD is used to calculate the number of no-failure tests needed to meet the expected reliability target according to the prior distribution; (3) the software statistical testing (SST) based on PRA is used as a reliability validation test method to assess reliability, when the required no-failure tests are completed, it is considered that the software meets the expected reliability target. The main contribution of this methodology is that it fully considers the factors that affect software reliability, i.e. the quality of development activities and verification & validation (V&V) activities of the SDLC processes, software operational profile and software operational environment when assessing software reliability. This is done such that the methodology overcomes the subjectivity of separate quality assessments of the SDLC processes. It also solves the problem that occurs because an individual SST using an uninformative prior distribution is conservative.

Fuzzy Reliability Assessment of Safety Instrumented Systems Accounting for Common Cause Failure

Reliability of safety instrumented systems (SISs) is a critical measure to ensure production safety of many industries. This paper focus on low-demand SISs. The reliability of these SISs is quantified by evaluating their probability of failure on demand (PFD). However, due to lack of knowledge, and/or vague judgments from experts, epistemic uncertainty associated with the parameters of components' degradation models is inevitable. Meanwhile, common cause failure (CCF) of two or more components caused by shared environments, often exists in SISs, reliability assessment for a SIS, therefore, becomes a challenging task. In this paper, fuzzy reliability assessment for SISs is conducted by taking account of the CCF among components of a SIS. The fuzzy Markov model is utilized to characterize the degradation process of components under fuzzy environment. The fuzzy state probability distribution of components is, then, calculated by formulating a set of constrained optimization models. Based on the fault tree of a SIS, the fuzzy PFD of the entire SIS with CCFs is formulated by using the $\beta $ -factor to quantify the CCFs. The fuzzy PFD at any $\alpha $ -cut level is, therefore, computed by a constrained optimization model. According to the optimization of parameters of SIS, the lower bound and upper bound of fuzzy PFD of SIS can be determined. Finally, we can quantify the effectiveness of CCF event for assessing the fuzzy PFD of SIS.

Genetic Algorithm Optimization Model for Determining the Probability of Failure on Demand of the Safety Instrumented System

A more accurate determination for the Probability of Failure on Demand (PFD) of the Safety Instrumented System (SIS) contributes to more SIS realiability, thereby ensuring more safety and lower cost. IEC 61508 and ISA TR.84.02 provide the PFD detemination formulas. However, these formulas suffer from an uncertaity issue due to the inclusion of uncertainty sources, which, including high redundant systems architectures, cannot be assessed, have perfect proof test assumption, and are neglegted in partial stroke testing (PST) of impact on the system PFD. On the other hand, determining the values of PFD variables to achieve the target risk reduction involves daunting efforts and consumes time. This paper proposes a new approach for system PFD determination and PFD variables optimization that contributes to reduce the uncertainty problem. A higher redundant system can be assessed by generalizing the PFD formula into KooN architecture without neglecting the diagnostic coverage factor (DC) and common cause failures (CCF). In order to simulate the proof test effectiveness, the Proof Test Coverage (PTC) factor has been incorporated into the formula. Additionally, the system PFD value has been improved by incorporating PST for the final control element into the formula. The new developed formula is modelled using the Genetic Algorithm (GA) artificial technique. The GA model saves time and effort to examine system PFD and estimate near optimal values for PFD variables. The proposed model has been applicated on SIS design for crude oil test separator using MATLAB. The comparison between the proposed model and PFD formulas provided by IEC 61508 and ISA TR.84.02 showed that the proposed GA model can assess any system structure and simulate industrial reality. Furthermore, the cost and associated implementation testing activities are reduced.

Assessment of the adequacy of safety barriers to hazards

The assessment of safety barriers performance is often achieved through tests or inspections in order to determine their availability or probability of failure on demand (PFD). The ultimate objective of these activities is to observe if the safety barrier is operational and to detect possible hidden failures. However, sometimes due to error in design or changes performed on the installation, the referred safety barrier is not adequate or no longer suitable to face the current level of risk. In the present paper is made a description of safety barriers as important means concerning risky situations and a methodology to evaluate the adequacy of a safety barrier is proposed. This methodology links the safety integrity level of an assessed safety barrier to the probability of occurrence of the hazardous event that it should protect. There is a pre-selection of the classified dangerous undetected safety function failures that will be used to determine the probability of failure on demand (PFD) and the safety barrier adequacy to a specific risk. It will be also possible to estimate the probability of occurrence of a hazardous situation corresponding to the simultaneity of the initiating hazardous event and the safety barrier fault (when a demand occurs).

Understanding IPL boundaries

Layer of protection analysis (LOPA) is a simplified risk assessment tool that has been in use for almost three decades. The technique has improved the focus on independent protection layers (IPLs) that can prevent the progression of an initiating cause to an undesired consequence (a scenario). An IPL must be capable of preventing the scenario from reaching the consequence. To execute the simplified LOPA approach, the IPL must be independent of the initiating cause and other IPLs.A potential pitfall in LOPA and in the management of IPLs identified in LOPA is misunderstanding the boundary of the IPL.For example, a pressure relief valve (PRV) is intended as an IPL to prevent the consequence of catastrophic rupture of the vessel with potential for fatality. In reality, for the PRV to prevent vessel rupture, the inlet piping from the vessel to the relief valve and the outlet piping from the relief valve to the ultimate destination must provide sufficient flow capability. The IPL boundary must include any block valves in the inlet and outlet piping, and any devices such as flame arrestors or back pressure controllers. The probability of failure on demand (PFD) must include everything in the expanded IPL boundary.If the IPL boundaries are not correctly understood, the LOPA is not correct and the organization is deluding itself on the risk reduction.In addition to being independent and effective in preventing the consequence, an IPL must also be auditable. If an IPL boundary does not include all the components to make the IPL effective, the audit (inspection and testing) program will be incomplete. The PFD of the excluded—but needed—components will be higher than the PFD of the same components that are audited. Narrow IPL boundaries give two problems in calculating the correct PFD: (1) Needed components are not included in the PFD calculation, and (2) The actual PFD of excluded components is higher than it would be if the components were inspected.The article provides examples and illustrations for several types of IPLs: safety instrumented functions, dikes, relief device with fire‐resistant insulation and cladding on the vessel, operator response to alarm, and deflagration arrester. The article includes diagrams to illustrate the concepts. © 2018 American Institute of Chemical Engineers Process Saf Prog 38: e12019, 2019

Use of combustible gas detectors in Safety Instrumented Systems – A practical application case study

A risk assessment carried out on a chemical process identified a flammable liquid release as a potential hazard. The flammable liquid, hexane, is used as a solvent in the process and is present in a dryer vessel during normal operations. The product from this vessel is a dry powder that is transferred to a packaging room directly below the vessel. Any leaks through the product discharge valve or inadvertent opening of the valve during the drying process or inadvertent opening/leak through of the hexane feed valves during the discharge process could lead to hexane release in the packaging room with potential for fire and explosion.It was determined that it was difficult to detect the absence of hexane in the dryer vessel as a prerequisite for discharging the final product to the packaging room using conventional process variables like level and pressure due to the complexity of the process. It was further determined that the best way to detect the release hazard was to use combustible gas detectors. An analysis was conducted which led to the design being considered a Safety Instrumented System and not a Fire and Gas System. Further risk assessments were conducted including a Fault Tree Analysis, Event Tree Analysis, and Probability of Failure on Demand (PFD) calculations for the combustible sensors as well as PFD average calculations for the Safety Instrumented Function (SIF) to confirm that the design of the SIF met the required risk reduction targets.

Impact of common cause failure on reliability performance of redundant safety related systems subject to process demand

Common Cause Failures (CCFs) can compromise reliability performance of safety related systems and hence configurations with identical redundant units receive special attention in many industries, including in automotive, aviation and process applications. This paper introduces a new reliability model for redundant safety related systems using Markov analysis technique. The proposed model entails process demand in conjunction with CCF and established system failure modes such as dangerous undetected failures for the first time and evaluates their impact on the reliability performance of the system. The reliability of the safety related systems is measured using the Probability of Failure on Demand (PFD) for low demand systems. The safety performance of the system is also appraised using Hazardous Event Frequency (HEF) to quantify the frequency of system entering a hazardous state that will lead to an accident if the situation is not controlled accordingly. The accuracy of the proposed Markov model is verified for a case study of flammable liquid storage tank overpressure protection system. It is demonstrated that the proposed approach provides sufficiently robust results for all demand rates, demand durations, dangerous undetected and CCF frequencies and associated repair rates for redundant safety related systems utilised in low demand mode of operation.

Unavailability assessment of redundant safety instrumented systems subject to process demand

The process industry has always been faced with the challenging task of determining the overall unavailability of safeguarding systems such as the safety instrumented systems (SISs). This paper proposes an unavailability model for a redundant SIS using Markov chains. The proposed model incorporates process demands in conjunction with dangerous detected and undetected failures for the first time and evaluates their impacts on the unavailability quantification of SIS. The unavailability of the safety instrumented system is quantified by considering the probability of failure on demand (PFD) for low demand systems. The safety performance of the system is also assessed using hazardous event frequency (HEF) to measure the frequency of system entering a hazardous state that will lead to an accident. The accuracy of the proposed Markov model is verified for a case study of a chemical reactor protection system. It is demonstrated that the proposed approach provides a sufficiently robust result for all demand rates, demand durations, dangerous detected and undetected failure rates and associated repair rates for safety instrumented systems utilised in low demand mode of operation. The effectiveness of the proposed model offers a robust opportunity to conduct unavailability assessment of redundant SISs subject to process demands.

Reliability modelling of redundant safety systems without automatic diagnostics incorporating common cause failures and process demand

Redundant safety systems are commonly used in the process industry to respond to hazardous events. In redundant systems composed of identical units, Common Cause Failures (CCFs) can significantly influence system performance with regards to reliability and safety. However, their impact has been overlooked due to the inherent complexity of modelling common cause induced failures. This article develops a reliability model for a redundant safety system using Markov analysis approach. The proposed model incorporates process demands in conjunction with CCF for the first time and evaluates their impacts on the reliability quantification of safety systems without automatic diagnostics. The reliability of the Markov model is quantified by considering the Probability of Failure on Demand (PFD) as a measure for low demand systems. The safety performance of the model is analysed using Hazardous Event Frequency (HEF) to evaluate the frequency of entering a hazardous state that will lead to an accident if the situation is not controlled. The utilisation of Markov model for a simple case study of a pressure protection system is demonstrated and it is shown that the proposed approach gives a sufficiently accurate result for all demand rates, durations, component failure rates and corresponding repair rates for low demand mode of operation. The Markov model proposed in this paper assumes the absence of automatic diagnostics, along with multiple stage repair strategy for CCFs and restoration of the system from hazardous state to the “as good as new” state.

Module level reliability performance evaluation of digital reactor protection system considering the repair and common cause failure

The Reactor Protection System (RPS) is designed and installed in the nuclear power plants (NPPs) to ensure both safety and economy. Nowadays the RPS adopts the digital techniques which consist of different digital modules. Therefore, this paper focuses on evaluating the reliability performance of the digital RPS using the Colored Petri Net (CPN) considering the module repair time whenever it fails and the Common Cause Failure (CCF). The module repair is considered as it takes some time to repair or replace the failed module and during the repair duration the digital RPS is operated in the degraded configuration and the common cause failure would severely impact the system in the event of occurrence. By studying the failure phenomenon and mechanism, the random probability shock model is adopted for CCF. Using the proposed model, the Monte Carlo simulation is carried out. Consequently, the indicators such as Mean Time To Repair (MTTR), Mean Time Between Failures (MTBF), Probability of Failure on Demand (PFD) and Probability of Spurious Trip (PST) are calculated. Following main conclusions are drawn i.e., i) the CCF is the main contribution to the PFD and PST. So the countermeasure for the CCF must be designed for the digital RPS; ii) the CCF has no effect on the MTTFF, MTBF, MTTR and subsystem unavailability; iii) the failure detection time has adverse effect on the system. Therefore, the digital system should shorten the detection time or decrease the coverage for the failures that take long time to be detected.

Optimization of Maintenance Schedule for Safety Instrumented Systems

Preventive maintenance plays an important role in the reliability of safety instrumented systems (SIS). In this paper, an approach is proposed for the optimization of maintenance schedule of SIS. The basic idea is to regard a SIS with preventive maintenance tests as a switched linear system with state jumps. Then the problem of finding the optimal time instants for maintenance tests is formulated as an optimal control problem of Bolza form. The average probability of failure on demand (PFD) is taken as the objective function. The proposed approach is able to take into account different types of maintenance tests and redundancy architecture. Examples are given to illustrate the proposed approach.

Unavailability model for demand-caused failures of safety components addressing degradation by demand-induced stress, maintenance effectiveness and test efficiency

The reliability, availability and maintainability (RAM) modelling of safety equipment has long been a topic of major concern. Some RAM models have focused on explicitly addressing the effect of component degradation and surveillance and maintenance policies, searching for an optimum level of the safety component RAM by adjusting surveillance and maintenance related parameters. As regards the reliability contribution, these components normally have two main types of failure mode that contribute to the probability of failure on demand (PFD): (1) by demand-caused and (2) standby-related failures. The former is normally associated with a demand failure probability, which is affected by the degradation caused by demand-related stress. Surveillance testing therefore not only introduces a positive effect, but also an adverse one, which it compensates by performing maintenance activities to eliminate or reduce the accumulated degradation. This paper proposes a new model for the demand failure probability that explicitly addresses all aspects of the effect of demand-induced stress (mostly test-induced stress), maintenance effectiveness (PAS or PAR model) and test efficiency. A case study is included on an application to a typical motor-operated valve in a nuclear power plant.

Optimization, a rational approach to SIL determination

Abstract In process industry, SIL determination is a risk assessment process through which target Safety Integrity Levels (SIL) are allocated to Safety Instrumented Functions (SIF). A target SIL represents the significance of the hazard against which the SIF protects the plant. This paper introduces new SIL determination methods by taking an optimization approach. Unlike the conventional methods, which are generally focused on calculating the gap between the existing and tolerable levels of risk, the methods introduced in this paper are aimed at optimizing the marginal cost or the benefit-cost ratio. By incorporating the cost factor into the SIL determination process, these methods deliver the most reasonably practicable solutions that can minimize the risk while taking into account the cost of solution. The new methods are formulated for corporate risk and the risk to community (i.e. ALARP). Both methods are derived for demand and continuous modes of SIF operation. Furthermore, a new Safety Index is introduced to combine the SIL and the average Probability of Failure on Demand (PFD) or Frequency of Failure per Hour (PFH). The application of the mathematical models is demonstrated through a practical example from power industry.