HOW SHOULD SHARED ELEMENTS BE TREATED IN THE CALCULATION OF FAILURE

PROBABILITYFORATRIPGROUP?
Inthiscontextatripgroupisasetofsafetyinstrumentedfunctions(SIFs)thatactivatesacommon
setofsharedfinalelements.
If two SIFs each respond to distinctly different hazardous events with independent causal events
thentheSIFsareeffectivelyindependent.TheriskreductionachievedbytheSISforonehazardous
eventisindependentoftheriskreductionforotherevents.
IfseveralSIFsinonecommontripgroupallrespondtocommonorrelatedhazardouseventsthen
theoverallriskreductionachievedmustconsideralloftherelatedSIFsintheSISasawhole.
Take theexampleofalargegasfired heaterorfurnace. Themostobviousscenariorequiringrisk
reductionrelatestothehazardousconsequencesofreignitionofunburntfuelafteraflameout(i.e
flamefailure,lossofcombustion).
The following functions are closely related and not independent because they all relate to the
scenarioofreignitionofunburntfuelfollowingflamefailure:
Flamefailure,trippingthemasterfuelvalves
Lowairflow,trippingthemasterfuelvalves
Lowgaspressure,trippingthemasterfuelvalves
Highgaspressure,trippingthemasterfuelvalves.
We cannot take risk reduction credit separately for these SIFs as if they were completely
independent.
They may be other separate SIFs responding to high tube temperature or high exhaust stack
temperature.Thosewouldbecompletelyunrelatedandwouldrepresentunrelateddemandsonthe
masterfuelvalve.
TheriskreductionrequiredforthefourflamefailureSIFscomesfromtheconsequenceofreignition
of unburnt fuel and the expected and the expected frequency of flame failure from all possible
causes.

ThefourSIFsrelatedtoflamefailureallrelyonthemasterfuelvalves.
InthecalculationoffailureprobabilitythefourSIFsneedtobetreatedasasinglesystem
sharingonecommonfinalelementsubsystem,onesharedlogicsolversubsystemandhaving
fourseparatesensorsubsystems(votedina1oo4arrangement).
Thecontributiontotheoverallprobabilityoffailureondemand(PFD)ofeachsensor
subsystemneedstobefactoredbytheproportionofcausaleventstowhichthatsensor
subsystemwillrespond.
Assumeforexample:

Theflamefailuresensorsarerequiredtorespondto100%offlamefailurescenarios.
Approximately30%offlamefailureiscausedbylowairflow
Approximately10%offlamefailureiscausedbyundetectedfailureofthegascontrolvalve
Approximately30%offlamefailureiscausedbylowgaspressure
Approximately30%offlamefailureiscausedbyhighgaspressure
The gas pressure sensors are completely independent of the flame failure sensors so for the
appropriateproportionofrelevanteventsitmightbejustifiabletomultiplytheprobabilityoffailure
ofthepressuresensorsbytheprobabilityoffailureoftheflamesensors.
Clearly the low gas pressure sensor is relevant only for low gas pressure events and the high gas
pressuresensorisrelevantonlyforhighgaspressureevents.Thesegaspressuresensorsubsystems
maysharesomecommoncausefailures(CCF)thataffectbothinthesameway(suchasrelatingto
thedesignoftheprocessconnections).
Similarlytheprobabilityoffailureofthelowairflowsensormaybemultipliedbytheprobabilityof
failureoftheflamefailuresensors.
Inthisexample:

0.3 0.3 0.3

0.6 0.1

ClearlytheoverallPFDofthesystemisstronglydominatedbythePFDofthefinalelements,asthey
needtofunctioncorrectlyforallflamefailureevents.
Thefinalelementsmayalsoneedtoprovideriskreductionforscenariosinvolvingfailureoftubing
carryingtheheattransferfluid.Thosescenariosmaybecompletelyunrelatedtoflamefailure.The
riskreductionrequiredforthosescenarioscanthenignorethedemandonthefinalelementsdueto
flamefailure.