Hazard and Safety Analysis: Method

Hazard and Safety Analysis

What the tool does

Three calculations that a system-safety engineer carries through a programme, in the order they are usually made. A hazard log records every hazard with the severity of its worst credible mishap and the probability that the mishap occurs, and the risk assessment matrix of MIL-STD-882E turns the pair into a risk level before and after mitigation. A layer of protection analysis (LOPA) takes one scenario of that log, multiplies the frequency of its initiating event by the probabilities that the independent protection layers fail on demand, and compares the result with a tolerable frequency; when the target is not met it states the risk reduction still required and the safety integrity level (SIL) of a safety instrumented function that would supply it. A SIL verification then checks a proposed function, subsystem by subsystem, against that level: its average probability of failure on demand from the failure rates, diagnostic coverage, proof-test interval and common-cause factors of its channels, and the architectural constraints of the standard. The three analyses are independent and may be run together or one at a time.

Hazard log and risk assessment (MIL-STD-882E)

Each line of the log names a hazard and gives its severity category from Table I of the standard, 1 Catastrophic (death, permanent total disability, irreversible significant environmental impact, or loss of $10M or more), 2 Critical (permanent partial disability, hospitalization of at least three personnel, reversible significant environmental impact, or $1M to $10M), 3 Marginal (a lost-work-day injury, reversible moderate environmental impact, or $100K to $1M) and 4 Negligible (less than any of these); and its probability level from Table II, A Frequent (likely to occur often in the life of an item), B Probable (several times), C Occasional (sometime in the life), D Remote (unlikely but possible), E Improbable (so unlikely it may be assumed not to occur) and F Eliminated, which the standard reserves for a hazard that was identified and later removed by design: no amount of training, warning or protective equipment moves a hazard to F. Roman numerals and the words are accepted, so a log kept in the MIL-STD-882C style of the FAA System Safety Handbook (I to IV, Frequent to Improbable) reads directly.

The severity category and the probability level together are the risk assessment code (RAC), for example 1C, and Table III assigns each RAC a level: High for 1A, 1B, 1C, 2A and 2B; Serious for 1D, 2C, 3A and 3B; Medium for 1E, 2D, 2E, 3C, 3D, 3E, 4A and 4B; Low for 4C, 4D and 4E; Eliminated for any F. The matrix is the standard's own (DoD, public domain) and is drawn by the tool with the hazards placed in their cells, the initial RAC in black and the residual RAC in blue. Tailored definitions or matrices are permitted by the standard only when formally approved and derived from Tables I to III; the tool applies the tables as printed.

The residual columns hold the assessment after the mitigation listed. The standard's order of precedence (4.3.4) is to eliminate the hazard by design selection, reduce the risk by design alteration, incorporate engineered features or devices, provide warning devices, and only then rely on signage, procedures, training and personal protective equipment; for Catastrophic and Critical hazards the last of these should not be the only mitigation, and it lowers the probability rather than the severity. The counts of hazards at each level before and after mitigation, the number reduced, unchanged or increased, and the highest residual level are reported. Before people, equipment or the environment are exposed, the residual risk is formally accepted (4.3.7); DoDI 5000.88 (2020, 3.6.e) names the acceptance authorities, the Component Acquisition Executive for High risks, a Program Executive Officer for Serious risks and the Program Manager for Medium and Low risks, with the user representative's concurrence before Serious and High acceptances. The tool prints the authority for every hazard's residual level.

Quantitative probability. When frequency or rate data exist the standard prefers them, and Appendix A gives an example banding (Table A-II) of the probability of occurrence over the life of an item: A at 10⁻¹ and above, B from 10⁻² to 10⁻¹, C from 10⁻³ to 10⁻², D from 10⁻⁶ to 10⁻³ and E below 10⁻⁶. A q (and q2) column in the log carries such a value and the level is set by these bands; the exposure the value refers to (item life, flight hours, firings, fleet size) should be recorded with the log. The FAA System Safety Handbook uses per-operational-hour bands for its own likelihood words (probable above 10⁻⁵, remote to 10⁻⁷, extremely remote to 10⁻⁹, extremely improbable below), a different scale that the tool does not apply.

Layer of protection analysis

A LOPA evaluates one cause-consequence pair. The initiating event (a control-loop failure, a human error, a loss of utility) occurs with a frequency f_i per year. Between it and the consequence stand the independent protection layers, each of which stops the scenario unless it fails on that demand with its probability of failure on demand PFD_j: the basic process control system, alarms with operator response, a safety instrumented function, a relief device, a dike, a check valve, each counted only if it is independent of the initiating event and of the other layers, effective against the consequence and auditable. Where the consequence needs further conditions, conditional modifiers (probability of ignition, of personnel being present, of injury given exposure) and enabling conditions (the fraction of time the hazardous state exists) multiply the frequency as well. The mitigated frequency is

f_mit = f_i · Π PFD_j · Π P_CM,k · Π P_EC,l

and the table lists the frequency after each factor in the order entered, with each factor's credit in decades (−log₁₀). The target frequency f_t is the tolerable frequency of the consequence from the owner's risk criteria for that consequence category; the tool does not ship any organisation's criteria. When f_mit ≤ f_t the target is met and the margin factor f_t/f_mit is reported. When it is not, the ratio f_mit/f_t is the risk reduction factor still required, an added safety instrumented function would need PFD_avg = f_t/f_mit, and that value is placed in its band of IEC 61508-1 Table 2 for the low-demand mode: SIL 1 for a PFD_avg from 10⁻² to below 10⁻¹, SIL 2 to 10⁻³, SIL 3 to 10⁻⁴ and SIL 4 to 10⁻⁵. A required PFD at or above 0.1 means a risk reduction below 10, which is not a SIL-rated function (it may still be an ordinary layer); one below 10⁻⁵ is beyond what a single function is credited with, and the scenario needs more layers or a smaller initiating frequency. The same arithmetic is used by the LANL calculation CEF-ENG-CAL-0465 for a criticality-facility SCRAM system, 10⁻¹ per year against 5 × 10⁻³ per year, which the tool reproduces (PFD below 5 × 10⁻², SIL 1).

A LOPA is an order-of-magnitude method: initiating frequencies and PFDs are normally taken in decades, and its result is a required integrity level, not a precise frequency. The method and the independence rules follow IEC 61511-3 Annex F and the CCPS book Layer of Protection Analysis, whose tables of initiating-event frequencies and layer PFDs are copyrighted and are not reproduced: every frequency and PFD is the analyst's entry, from the owner's data or the published guidance.

SIL verification

A safety instrumented function (SIF) is made of subsystems in series for the dangerous function: the sensors, the logic solver and the final elements. Each subsystem has N identical channels in an MooN architecture: the function is performed when M of the N channels work, so 1oo1 and 2oo2 fail dangerously on the first dangerous channel failure, 1oo2, 1oo2D and 2oo3 on the second, 1oo3 on the third (their hardware fault tolerance HFT is 0, 1 and 2). A channel's dangerous failure rate λ_D is split by the diagnostic coverage DC into a detected part λ_DD = DC λ_D, revealed by the automatic diagnostics and restored within the mean time to restoration MTTR, and an undetected part λ_DU = (1 − DC) λ_D, found only at the proof test every T₁ hours and repaired within MRT. Rates are entered in FIT (failures per 10⁹ hours); 100 FIT is 10⁻⁷ per hour.

Simplified equations. IEC 61508-6 Annex B gives first-order expressions built on the channel-equivalent mean down times t_CE = (λ_DU/λ_D)(T₁/2 + MRT) + (λ_DD/λ_D) MTTR, t_GE with T₁/3 and t_G2E with T₁/4 for the second and third failure of a group, and on the β-factor model of common cause: a fraction β of the undetected and β_D of the detected dangerous rate fails every channel at once. Then PFD_avg = λ_D t_CE for 1oo1, 2 λ_D t_CE for 2oo2, 2 λ_I² t_CE t_GE + β_D λ_DD MTTR + β λ_DU (T₁/2 + MRT) for 1oo2 with λ_I = (1 − β_D) λ_DD + (1 − β) λ_DU the independent rate of one channel, the same with 6 for 2oo3, 6 λ_I³ t_CE t_GE t_G2E plus the common-cause terms for 1oo3, and for 1oo2D 2 (1 − β) λ_DU [λ_I + λ_SD] t′_CE t′_GE plus the common-cause terms, where the safe-detected rate λ_SD = DC λ_S also takes a channel out of a 1oo2D group. These are mathematics, not tables; the standard's own tables of example results are not reproduced.

Exact Markov model. Beside every simplified value the tool solves the same assumptions exactly. The subsystem is a continuous-time Markov chain whose states count the channels failed undetected, failed detected and under repair (rate 1/MTTR each), failed safe-detected (1oo2D only) and found by the proof test and under repair (rate 1/MRT). From a state with g working channels the independent transitions are g (1 − β) λ_DU and g (1 − β_D) λ_DD, and the common-cause transitions β λ_DU and β_D λ_DD fail all g at once. The chain runs over the proof-test interval through its matrix exponential (a Padé approximation with scaling and squaring); at T₁ the proof test moves every undetected failure into the post-test repair state; the cycle is repeated until the distribution at the start of the interval no longer changes, which is the periodic steady state. PFD_avg is the exact time average of the probability of the dangerously failed states over the interval, obtained from the integral of the transition matrix (the augmented-matrix exponential, no quadrature), and PFD(t) is the sawtooth drawn in the figure: it climbs from the post-test value as undetected failures accumulate and drops at the next test. For undetected failures alone the model reduces to the closed forms 1 − (1 − e^−λT)/(λT) ≈ λT/2 for one channel and ≈ (λT)²/3 for a pair tested together, the expressions NUREG/CR-6823 gives for periodically tested standby components. The simplified equations agree with the exact model within a few percent when λ_DU T₁ is small, which is the condition under which they were derived; the tool reports the ratio and flags a subsystem whose λ_DU T₁ exceeds 0.1.

Architectural constraints. The safe failure fraction SFF = (λ_S + λ_DD)/(λ_S + λ_DD + λ_DU) is the share of a channel's failures that are safe or detected. IEC 61508-2 (route 1_H, Tables 2 and 3) limits the SIL a subsystem may claim by its SFF band (below 60 %, 60 to 90 %, 90 to 99 %, 99 % and above) and its hardware fault tolerance: a type A subsystem (simple, with all failure modes defined) claims SIL 1, 2 or 3 at HFT 0, 1 or 2 in the lowest band and one SIL more per band up to SIL 4; a type B subsystem (complex, microprocessor-based) one SIL less in every cell, and nothing at HFT 0 below 60 %. The function's SIL is the lower of the SIL given by its PFD_avg (the sum of the subsystem values; the exact union 1 − Π(1 − PFD_i) is printed beside it) and the lowest architectural limit among its subsystems, and it is compared with the required SIL entered, which may come from the LOPA. The risk reduction factor is 1/PFD_avg.

Reading the results

In the hazard log the rank orders the hazards by residual level, then initial level, then severity; the figure shows at a glance which cells remain occupied after mitigation, and a hazard still in a High cell needs more design work before acceptance. In the LOPA the step table shows where the decades of protection come from; a scenario that relies on a single layer for several decades is suspect, and a conditional modifier that supplies most of the reduction deserves justification. In the SIL verification the subsystem with the largest share drives the result: for a single channel PFD_avg ≈ λ_DU T₁/2, so a shorter proof-test interval or a higher coverage lowers it in proportion; for a redundant group the common-cause term β λ_DU T₁/2 is the floor, which only diversity, separation (a lower β) or more frequent testing moves. A function that meets the PFD band but fails the architectural constraint needs a higher SFF (more diagnostics) or an added channel, not a shorter test interval.

Limits

The hazard log applies MIL-STD-882E as printed and does not carry software control categories (Table IV) or tailored matrices. The LOPA treats every layer as independent and does not evaluate the independence itself, nor does it carry frequency or PFD data. The SIL verification covers the low-demand mode only (PFD_avg, not PFH), assumes identical channels within a subsystem, simultaneous (not staggered) proof tests with full coverage, and the β-factor common-cause model; systematic capability, software integrity and the multiple-Greek-letter and alpha-factor models are outside it. The frequencies, rates, coverages and β factors are the analyst's entries from certificates, field data or published guidance.