Tools › Reliability › Safety Analysis › Hazard and Safety Analysis › Example
Hazard log by MIL-STD-882E, a LOPA with two protection layers and the LANL SCRAM SIL determination, and a 1oo2 / 1oo1 / 1oo1 safety function verified
| Tool | Hazard and Safety Analysis |
| Source | U.S. Department of Defense (2012). Department of Defense Standard Practice: System Safety. MIL-STD-882E, 11 May 2012. Tables I, II, III and A-II; Strelow, J. M. (2015). Layer of Protection Analysis for SIL Determination of the SCRAM System. LA-UR-15-23087, Los Alamos National Laboratory, Los Alamos, NM; Atwood, C. L., et al. (2003). Handbook of Parameter Estimation for Probabilistic Risk Assessment. NUREG/CR-6823, U.S. Nuclear Regulatory Commission, Washington, DC. Sections 2.3.3 and 2.3.4. |
| Level | Professional |
Problem
Assess a six-hazard log by the MIL-STD-882E risk assessment matrix before and after mitigation and name the acceptance authority of each residual risk. For a scenario with an initiating frequency of 0.1 per year, two independent protection layers of PFD 0.1 and an ignition probability of 0.5, find the mitigated frequency against a target of 10⁻⁵ per year and the SIL of a safety instrumented function that would close the gap; repeat for the LANL SCRAM case (0.1 per year against 5 × 10⁻³ per year, no layer). Verify a function with 1oo2 pressure transmitters (λ_D 300 FIT, DC 60 %, β 5 %), a 1oo1 logic solver (100 FIT, DC 99 %, type B) and a 1oo1 shutdown valve (2,000 FIT, DC 0, λ_S 3,500 FIT) proof-tested every 8,760 h with MTTR 8 h against SIL 2.
Inputs to Enter
- Hazard log: six hazards with severity 1–4, probability A–F and residual values, e.g. H1 hydraulic line rupture 1C → 1E, H4 fall from platform 2B → 3D, H6 noise 4A → 4C
- LOPA: f_i 0.1 /yr, BPCS PFD 0.1, relief valve PFD 0.1, probability of ignition 0.5 (conditional modifier), target 1e-5 /yr
- SIF: transmitters 1oo2 300 FIT DC 60 % λ_S 500 FIT β 5 % β_D 2.5 %; logic 1oo1 100 FIT DC 99 % λ_S 1,000 FIT type B; valve 1oo1 2,000 FIT DC 0 λ_S 3,500 FIT; T_1 8,760 h, MTTR 8 h, MRT 8 h, required SIL 2
Answers
- Hazard log: initial risk High 2, Serious 2, Medium 2 (H1 1C and H4 2B High); residual Medium 5, Low 1, no High or Serious left; highest residual Medium, accepted by the Program Manager (DoDI 5000.88)
- LOPA: f_mit = 0.1 × 0.1 × 0.1 × 0.5 = 5 × 10⁻⁴ /yr; gap 50 → PFD required 0.02, SIL 1 (band 10⁻² to 10⁻¹); LANL case: PFD < 5 × 10⁻², SIL 1 as the calculation prints
- SIF simplified equations: transmitters 2.671 × 10⁻⁵ (common cause 2.636 × 10⁻⁵), logic 5.18 × 10⁻⁶, valve 8.776 × 10⁻³; function PFD_avg 8.808 × 10⁻³, RRF 113.5, SIL 2 by PFD
- Exact Markov models: 2.666 × 10⁻⁵, 5.18 × 10⁻⁶, 8.725 × 10⁻³ (function 8.756 × 10⁻³); SFF 85 % / 99.9 % / 63.6 %, architectural limits SIL 3 / 3 / 2; SIL achieved 2, required SIL 2 met
Notes
The tool's default inputs are this case; press Submit. The hazard log and the SIF values are illustrative (the 882E tables and the DoDI acceptance authorities are the printed facts); the LOPA arithmetic of the LANL calculation is reproduced to its printed digits; the Markov values are checked against scipy expm in References/Hazard-Safety/checks/.