Kristiansen Svein. Maritime Transportation: Safety Management and Risk Analysis
Подождите немного. Документ загружается.
where P
SF
¼reliability of structure and P
i
¼reliability of structure i. The reliability P
is defined as the survival probability (of a component or system) and is dependent on
the operation time and operational conditions. The failure probability Q is equal to the
probability of non-survival (1 P ).
When applying quantitative techniques the validity of the data should be carefully
assessed. In general the data are only valid for the environment (i.e. the operational
conditions) from which they are collected. Failure data for the same fabricates of a
diesel engine in onshore operations may be different from operations offshore in a ship due
to different operational co nditions/environments. In add ition the quality of maintenance
greatly influences the failure rate as well as the operational profile. Hence all failure
data should be given a validity and sensitivity assessment. The result of such an assessment
may be that the data is considered suitable, rejected, or adjusted according to ‘expert
judgement’.
8.4 PRELIMINARY HAZARD ANALYSIS (PHA)
Systems that are targeted for risk analyses are often quite complex, and the hazards facing
the system may not therefore be completely obvious. Hence, after the system description is
performed, the next task should be to identify possible hazards. The obj ective is to identify
all possible events and conditions that may result in any severity or harm. A systemized
way to identify such hazards is to apply the Preliminary Hazard Analysis (PHA)
methodology described in this section.
8.4.1 Principle
The principle (or objective) is to identify hazards that may develop into accidents. This
is done by generating situations or processes that are not planned or meant to happen.
It is important to identify the hazards as early as possible in the design process in order
to implement corrective measures in the design. This is known as proactive risk
management/reduction.
8.4.2 Approach
In order to generate the hazardous situations or processes, deviations from the normal
operation have to be considered. It may be difficult to get started with this exercise. Some
deviations can, however, be established by making use of the cues below:
. More of ... . Both ...and ...
. Less of ... . Another than ...
. Nothing of ... . Opposite direction ...
. Part of ... . Later than ...
Another approach is to identify parameters relate d to possibl e energy transfe rs.
Accidents are often uncontrolled releases or transfers of energy, e.g. as in an uncontrolled
fire. By identifying the en ergy sources, several hazardous events or processes can be
established.
216 CHAPTER 8 RISK ANALYSIS TECH NIQ UES
8.4.3 Elements
The PHA may seem like a very general and non-specific exercise and that is exactly what
it is. To facilitate matters for the analyst, it is therefore important to systemize the
deviations. There are several ways to do this systemization and the analyst should adapt
a system suitable for the system and/or situation he or she is to analyse. Table 8.2 is a
general table for identifying the hazards.
Exam p le
Problem
An oil tanker may introduce hazards to personnel, property and the environment. These
hazards have to be identified as a basis for further risk analyses. Perform a Preliminary
Hazard Analysis (PHA) for the tanker and sketch the accident development using the
form presented in Table 8.2 above.
Solution
Figure 8.6 is a diagram of the oil tanker.
Assumptions:
Stability and buoyancy considerations are not treated here. Only kinetic energy and cargo
energy are treated further.
Analysis:
Based on the energy considerations a PHA is performed for the tanker’s kinetic energy
and cargo energy, as shown in Tables 8.3–8.5.
These tables are not exh austive. Can you, for example, find any other hazardous
conditions relating to the kinetic energy of the oil tanker and the cargo’s energy?
8.5 HAZARD A ND O PERABILITY STUDIES (HAZ OP)
A Hazard and Operability Study, popularly known as HAZOP, is a more detailed and
comprehensive hazard identification method than the PHA. The basic idea of HAZOP is
Ta b l e 8 . 2 . Form applied in PHA
Hazardous
element
Trigging
event 1
Hazardous
condition
Trigging
event 2
Potential
accident
Effect Corrective
measures
Ship’s
dependence
on buoyancy
Compart-
ments not
watertight
Potential
intake of
water is
large and
uncontrolled
Heavy
sea
Ship goes
down
Fatalities,
environ-
mental
damage,
loss of ship
and cargo
Increase
number
of watertight
compartments,
avoid heavy
sea
... ... ... ... ... ... ...
Source: Henley and Kumamoto (1981).
8.5 HAZARD AND OPERABILITY STUDIES (HAZOP) 217
to systematically search for deviations from the normal operation of the system that
may have harmful consequences.
8.5.1 Principle
The principle (or objective) is to systematically examine the system part by part and
then define the intention to each part. The intention is the way the system is expected
to work. When the intentions are defined, possible deviations from the system’s intentions
that may lead to hazardous situations can be identified. The use of so-called guiding
words may assist the analyst in the identification of such deviations. For the analysis
process to be successful, a team consisting of specialists in several fields should supervise
the analysis.
Table 8.3. PHA for the tank er ’s cargo oil
Hazardous
element
Trigging
event 1
Hazardous
condition
Trigging
event 2
Potential
accident
Effect Corrective
measures
Cargo oil Rupture of
cargo
tanks
Cargo oil
leaks into
the sea
Spill exposes
animal life
Spill has
consequen-
ces for the
environment
Environmental
damage, hull
damage
Increase the
rupture
resistance
of the
tanks
Cargo oil Rupture of
cargo
tanks
Cargo oil
leaks into
the sea
Oil is
ignited
Fire on the
surface
Fatalities,
environ-
mental
damage,
wrecked ship
Increase the
rupture
resistance of
the tanks
Figure 8.6. The oil tanker under consideration.
218 CHAPTER 8 RISK ANALYSIS TECH NIQ UES
8.5.2 Approach
The first task is to get an overview of the system using a system description as described
in Section 8.3 of this chapter. The system ha s to be divided into sections with independent
intentions, and the intention of each part has to be carefully defined. In a real system all
sections or subsystems are dependent on each other to a greater or lesse r extent , and these
dependencies must be identified.
When the intentions for each part of the systems have been defined, the system
description is complete. Then one can start identifying deviations for each part of the
system. Guidewords may assist the creativity of the analyst in order to establish as many
deviations as possible, and these guidewords are applied one at a time. When the
deviations are identified the causes of the deviations can be found and the reasons for the
occurrence of the causes can be identified. The identification of causes results in greater/
increased problem understanding and based on this safety measures can be established.
These safety measures can be related to changes in processes, process parameters, design,
routines, etc. The whole procedure is repeated for each part and section of the system as
shown in Figure 8.7.
8.5.3 Elements
The most important resource for a HAZOP analysis is a detailed system description as
well as access to complete part intention knowledge. When these resources are established,
Ta b l e 8 . 4 . PHA for the tan k e r ’s cargo oil vapour
Hazardous
element
Trigging
event 1
Hazardous
condition
Trigging
event 2
Potential
accident
Effect Corrective
measures
Cargo oil
vapour
Leakage in
pump
room
Explosive
gas
mixture
Ignition of
gas
Explosion Fatalities,
environ-
mental
damage,
material
damage
Install pumps
in the
individual
tanks
Cargo oil
vapour
Cargo vapour
in loaded
cargo tanks
Explosive
gas
mixture
Ignition of
gas
Explosion Fatalities,
environ-
mental
damage,
material
damage
Inert gas
system
Cargo oil
vapour
Cargo vapour
in empty
cargo tanks
Explosive
gas
mixture
Maintenance
causes igni-
tion of gas
Explosion Fatalities,
material
damage
Inert gas
system
Cargo oil
vapour
Cargo
vapour in
empty cargo
tanks
No oxygen
in tanks
Maintenance
personnel
enters tank
Personnel
asphyxi-
ated
Fatalities,
injuries
Oxygen level
measure-
ment
8.5 HAZARD AND OPERABILITY STUDIES (HAZOP) 219
a set of guidewords may assist the analyst in identifying deviations. These guidewords
are presented in Table 8.6.
The HAZOP procedure is further explained in the example below.
Exam p le
Problem
The mobility of a vessel is highly dependent on the propeller. If the propeller fails for some
reason, the whole propulsi on system and navigation system is put out of operation and the
ship’s movement is out of control. It is therefore clear that the propeller is a critical
component. As part of a HAZOP procedure the controllable pitch propeller (CPP) in
Figure 8.8 is identified as a part with individual intention. Perform a single loop in the
HAZOP procedure for the CPP.
Solution
Assumptions:
The analysis is to emphasize loss of propeller function. The case of degraded operation is
not considered here.
Ta b l e 8 . 5 . PHA for the tanker’s kinetic energy
Hazardous
element
Trigging
event 1
Hazardous
condition
Trigging
event 2
Potential
accident
Effect Corrective
measures
Kinetic
energy
Loss of
navigational
control
Tanker sails
on random
course
Another
ship is on
the tanker’s
course
Collision,
rupture of
cargo tanks
Fatalities,
environmental
damage,
damage to hull
Improving
navigational
standards
Kinetic
energy
Loss of
navigational
control
Tanker sails
on random
course
Stationary
obstacle on
the tanker’s
course
Powered
grounding,
rupture of
cargo tank
Fatalities,
environmental
damage,
damage to hull
Improving
navigational
standards
Kinetic
energy
Obstacle on
the tanker’s
course
Retardation
(i.e. reverse)
Movement
of unfas-
tened mate-
rial onboard
vessel
Crushed
personnel,
material
damage
Fatalities,
environmental
damage
Fasten
material
properly
Kinetic
energy
Drifting/
unfastened
material
Ignition
source
Combusti-
ble material
present
Fire,
explosion
Fatalities,
environmental
damage,
material
damage
Fasten
material
properly,
remove
combustible
material
220 CHAPTER 8 RISK ANALYS IS TECHNI QU ES
Analysis:
Definition of CPP intention: the propeller is to trans form rotational energy, transmitted
through the propeller shaft, into a pressure difference over the propeller blades. It is this
pressure difference that accelerates and maintains the speed of the vessel. The controllable
pitch’s intention is to optimize this energy transformation for various operational
conditions.
Table 8.6. Guide words for the ident ification of deviation
Guideword Description
NO or NOT No part of the intention is achieved
MORE Quantitative increase in flow rate or temperature, for example
LESS Quantitative decrease
AS WELL AS Qualitative increase. Intention is achieved plus additional activity like
too much flow
PART OF Qualitative decrease. Degraded intention achieved
REVERSE Logical opposite of intention, e.g. reverse flow
OTHER THAN Complete substitution. Something quite different happens
Figure 8.7. Main stages in the HAZ OP procedure.
8.5 HAZARD AND OPERABILITY STUDIES (HAZOP) 221
Deviations are identified in Table 8.7 and their causes and safety measures listed in
Table 8.8.
These tables are not exhaustive. Other deviations are possible, and to find these one
must be creative and have a good unde rstanding of the system.
Comment
The whole procedure should be repeated for all parts/subsystems of the propulsion and
navigation system in a proper and comprehensive risk analysis.
8.6 FAILURE MODE, EFFECTAND CRITICALITYANALYSIS (FMECA)
The Failure Mode, Effect and Criticality Analysis (FMECA) is a systemized inductive
method of determining equipment functions, functional failure modes, assessing the causes
Ta b l e 8 . 7. Id e nt ifi cat i on of d e viati ons
No. Guideword Description
1 NO pitch No rotational energy is transformed
2 NO blade No rotational energy is transformed
3 NO control bar All blades on random pitch, loss of operational control
4 NO crank wheel One or all blades have independent pitch
5 NOT enough material strength Parts of the propeller break down
6 MORE pitch than optimal Too heavy load on propulsion system. Cavitation
7 LESS pitch than optimal Too little load on propulsion system. Cavitation
8 LESS draft than allowed Propeller is not sufficiently submerged. Loss of thrust
9 LESS depth than necessary Propeller hits the ground and is damaged
Figure 8.8. Control l ab l e pitc h propelle r (C PP).
222 CHAPTER 8 RISK ANALY SIS TECHN IQU ES
of such failures and their effects (or consequences), as well as their effect on pro duction
availability and reliability, safety, cost, quality, etc., on a component level. The failure
modes are normally and preferably analysed by the use of a standardized form that
describes the failure, its causes and how it is detected, the various effects of the failure,
as well as assessing important parameters such as failure rate, severity and criticality.
FMECA is a qua ntitative method. However, the origi nal version of FMECA is a
qualitative version where the measured criticality is excluded, i.e. Failure Mode Effect
Analysis (FMEA). Therefore, FMECA is still often described as a qualitative method in
the literature.
8.6.1 Principle
The simple standardized forms used in FMECA assist the analyst to review the possible
failure modes and identify their effects. The FMECA method can be used systematically to
identify the most effective risk-reducing measures, which assist the process of selecting
suitable design alternatives in an early design phase. As such the FMECA may be a
valuable historical document for future design changes. The FMECA method is also used
to form a basis for extensive quantitative reliability analyses with the objective of
establishing sound maintenance strategies.
Ta b l e 8 . 8 . Causes for the deviations and safety measures
No. Causes Safety measures
1 Operation failure or control mechanism
failure, alignment mechanism defect
See 2, 3, 4 and 5
2 Object in the water breaks the blade Implementation of propeller protection
such as gratings or water jet. Sail in
ice-free waters. See 7 and 8
3 Material weakness Improve design and construction
4 Material weakness Improve design and construction
5 Wrong design, corrosion or cavitation,
alignment mechanism is defective
and causes different pitch on the
blades which again causes extra load
on bearings and shaft line
Validate propeller design, cathodic
protection, appropriate propeller
material, test the propeller against
cavitations, periodic alignment
adjustment
6 Operation failure Surveillance, increase operator
competence
7 Operation failure Surveillance, increase operator
competence
8 Operation failure Surveillance, increase operator
competence
9 Operation failure Technical equipment, operator
competence and surveillance
8.6 FAILURE MODE, EFFECTAND CRITICALITYANALYSIS (FMECA) 223
According to the Institut ion of Electrical Engineers (IEE), standard 352, an FMECA
should give an answer to some basic questions:
. How can each part conceivably fail?
. What mechanisms might produce these modes of failures?
. What could the effects be if the failure did occur?
. Is the failure detected?
. What inherent provisions are provided in the design to compensate for the failure?
8.6.2 Approach
The first step of any risk analysis technique/method is, as described in Section 8.3 of this
chapter, the system description. In general the approach to FMECA is to perform the
following six stages:
1. Genera l description of the components.
2. Description of possible failures and failure modes.
3. Description of failure effects for each failure mode.
4. Grading the failure effects in terms of frequency, and severity of con sequences, as well
as specifying reliability data.
5. Specifying and assessing methods for the detection of failure modes.
6. Description of how unwanted failure effects can be reduced and eliminated.
The standardized form, which is thoroughly explained later, aids the analyst’s approach
to the method.
8.6.3 Elements
The failure modes are important parameters in the FMECA method. A failure mode can
be defined as the effect by which a failure is observed on a failed component/item. There
are in principle two types of failure modes which are characterized, respectively, as
unwanted change of condition and demanded change not achieved. The quantitative
part of the method is given by the use of standardized terms for failure frequencies and
consequences. The terms describing the failure frequencies are presented in Table 8.9.
The possible failure consequences are measured using the consequence classes given
in Table 8.10.
Exam p le
Problem
The loss of propulsion power directly results in a loss of the controlled mobility of
the vessel. In the HAZOP of the propeller (see earlier example) it was assumed
that the controllable pitch propeller (CPP) was a critical subsystem for the propulsion
system. The criticality is, however, dependent on the failure consequence and the failure
224 CHAPTER 8 RISK ANALYS IS TECHN IQU ES
likelihood. Hence an FMECA of the whole propulsion system may be appropriate. Find
the elements and descriptions to be filled in the FMECA form.
Solution
A description of the propulsion system is given in Figure 8.4. The FMECA form to be
used is outlined in Figure 8.9. The content of the FMECA form presented in Figure 8.9 is
not exhaustive, especially in terms of failure causes.
8.7 FAULT TREE ANALYSIS (FTA)
One of the most frequent ly used techniques in risk analyses is fault tree modelling. In the
introduction to Chapter 7 an example of a fault tree was presented. A fault tree analysis
(FTA) can be used to identify the subsystems that are most critical for the operation
of a given system, or to analyse how undesirable events occur. The methodology was
developed in 1962 by H. S. Watson at the Bell Telephone Laboratories during the
development of the ‘Minuteman’ rocket’s combustion chamber.
8.7.1 Principle
In the context of risk analyses the FTA method is used to analyse the way an unwanted
event occurs, as well as its causes. By the use of a logical diagram the relationship between
Ta b l e 8 . 9. Frequency classes
Frequency classes Quantification
Very unlikely Once per 1000 years or more rarely
Remote Once per 100–1000 years
Occasional Once per 10–100 years
Probable Once per 1–10 years
Frequent More often than once per year
Ta b l e 8 . 1 0 . Conseque n ce classes
Consequence classes Quantification
Catastrophic Any failure that can result in deaths or injuries or prevent performance of
the intended mission
Critical Any failure that will degrade the system beyond acceptable limits and
create a safety hazard
Major Any failure that will degrade the system beyond acceptable limits but
can be adequately counteracted or controlled by alternative means
Minor Any failure that does not degrade the overall performance beyond
acceptable limits – one of the nuisance variety
8.7 FAULT TREE ANALY S IS ( FTA) 225