CET vol 99 DOI: 10.3303/CET2399024 Paper Received: 31 January 2023; Revised: 20 March 2023; Accepted: 24 April 2023 Please cite this article as: Zenier F., Antonello F., 2023, Albatros Iii: an Integrated Software to Obtain the Fault Tree, Sil Level and MCS from the Hazop, Chemical Engineering Transactions, 99, 139-144 DOI:10.3303/CET2399024 CHEMICAL ENGINEERING TRANSACTIONS VOL. 99, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Sauro Pierucci, Flavio Manenti Copyright © 2023, AIDIC Servizi S.r.l. ISBN 978-88-95608-98-3; ISSN 2283-9216 ALBATROS III: an Integrated Software to Obtain the Fault Tree, SIL Level and MCS from the Hazop Fausto Zenier*, Franco Antonello ARTES Analisi Rischi e Tecnologie di Ecologia e Sicurezza, Mirano, Italy fausto.zenier@artes-srl.org In the field of risk analysis regarding major accidents, the most commonly adopted techniques of analysis and evaluation are HazOp and Fault Tree Analysis (FTA), which have many application software and available established procedures to support risk analysts.Albatros III, developed on the basis of the experience gained with the previous software (Antonello et al. 2009, ref. [1]), aims to minimize wasted time by processing Fault Trees and Minimal Cut Sets (MCS) on the basis of the Hazop application.Basing the construction of the fault tree on the Hazop analysis also allows a more accurate and complete evaluation of the results.Fault trees are automatically obtained in graphical form and quantified. The MCS are also processed and displayed both by breaking down into categories associated with the different types of instrumentation, and by indicating the equations that compose them, with the level and incidence of the individual items. In this way it is also easy to obtain the SIL.A database containing reliability datasets is linked to the AlbatrosIII software, allowing the choice of individual data for the automatic calculation of the expected failure frequency or PFD of the system. 1. Introduction Systems reliability and human errors are key elements in risk analysis. Many methods are available for their evaluation and there are also various software for calculating the expected frequency or probability of failure. AlbatrosIII is the only software that implements the integration between HazOp and Fault Tree Analysis ensuring time saving and also allowing the development of Minimal Cut Sets (MCS). This integration was conceptually presented back in the 80s (Lihou D.A. 1980, ref. [2]-[3]), but was developed with dedicated software only about ten years later and subsequently refined, also on the basis of further studies (Piccinini et al. 2002, ref. [4]), until the release of AlbatrosIII software. AlbatrosIII uses worksheets (MS Excel® type) for HazOp writing and Fault Trees with MCS development and reporting.The application of the HazOp methodology is done according to classical criteria, but using unique codes associated with elementary (primary) events descriptors. The software allows the choice of predefined guide words for the hazop, which can also be integrated by the user, with the opportunity to further qualify the deviation, for example, specifying "+ FLOW feed” or “– FLOW water" etc. or "≠COMPOSITION +air” or “≠COMPOSITION -water", so as to describe the event as accurately as possible. The software includes a database with over 1700 cards containing reliability data taken from international databases related to mechanical, instrumental, electronic, electronic programmable, or human errors which may be automatically associated to the single primary event on the basis of a user choice, or which can be used by the experts as an aid in the choice of failure rate or error probability. The representation of a typical HazOp worksheet is shown in Figure 1. 2. Application criteria To ensure proper operation the software requires the application of some conventions, in order to limit users discretion. The main ones are: • the use of mandatory parameters (temperature, pressure, flow rate, level, composition), • the use of abbreviations to indicate the type of failure or event (e.g. H.E. = Human Error, etc.) with a series of predefined terms which can anyway be customized by the user, 139 • the causes must correspond to elementary events, i.e. failures, anomalies, human errors, ..., which can be associated to an expected frequency, • each event must be associated with the code reported in the P&I in order to obtain the list of critical components and allow MCS equations development, • for each identified cause an effect or consequence is identified, which may consist of a deviation of another parameter in the same node or in another node, or an ultimate consequence (Top Event), • the guide words can be used to describe a sequence of effects, each of which will become cause of a further effect, as exemplified in Figure 1 Figure 1: HazOp Worksheet 2.1 Articulation of the file containing the worksheets The HazOp worksheet is divided into 4 sections: 1) parameters, 2) causes, 3) effects, 4) “And” events-remedies (these latter consisting of alarms or switches failure or human errors, or equipment unavailability). All terms identifying these categories of events can be predefined by the user in an auxiliary worksheet (“Parameters”, “Initial”, “Intermediate”, “Finals”, “And”). Each category consists of 50 entries and the user can change terms or add new ones using MS Excel® rules. The details and meaning of the abbreviations used in the worksheet are set out in the User Manual supplied with the software. 2.2 Working technique for the preparation of the HazOp worksheet The user enters the details of the HazOp using the mouse keys (right key to open the menus as in Figure 2) taking care to report the complete sequence of events leading up to the Top Event. Figure 2: example opening menu It is possible to go back using the [Esc] key; the contents of the cells and rows can be copied following the rules of MS Excel® and the instruction provided with the User Manual. In the sequences of events that originate Top Events (also called final events), in addition to the causes, also the presence of safety barriers (elements or components that can prevent the occurrence of unwanted events or through which it is possible to minimize 140 their impact) must be considered. These elements consist in alarms or switches systems or safety components such as PSV or rupture discs or also controlling measures and actions entrusted to man or computer systems. All of these safety barriers are able to timely detect the occurrence of events or failures and implement appropriate measures of prevention or protection.These elements are considered or expected as a result of the analysis and it’s possible to evaluate their unavailability and weigh the influence they may have towards the final result, that is, the expected frequency of the Top Event. If a sequence of events affects several nodes, the columns "FR = from the node" and "TO = to the node" are used to indicate the source and destination nodes. Once the HazOp has been edited and the file saved, AlbatrosIII is started and the preliminary checks are carried out. Indeed, one of the advantages provided by the software is the possibility of verifying the completeness and consistency of the analysis, especially in cases of complex analysis with many causes / effects sequences involving multiple nodes. The software allows to check if there are repetitions or duplications or interruptions of the sequences of events. The control is activated by clicking on the box "Verifica HazOp", as shown in the following figure. Figure 3: example of activation control If there are errors, they are reported in the Errors sheet, as shown in the following figure Figure 4: example of errors reporting When the check is positive, one can go to process the Fault Trees using the "Processing" button. 2.3 Fault Tree and Minimal Cut Set Setting the analysis and respecting the conventions described above allows to obtain directly the Fault Trees from HazOp. It is possible to obtain only the Fault Tree graph (without any calculation) or the quantified Fault Tree graph (with the frequency/probability calculation). To obtain the quantified fault trees it is necessary to open the database file and choose the failure rates or error probabilities for all the events involved in the accident sequence. This operation is performed using the "Affidab" sheet, an example of which is shown in the Figure 5. To enter the failure rates, simply enter the card number of the database and click with the right mouse button: the program will automatically enter the average rates. You can choose between λD or λDU, in order to apply the appropriate reliability calculation relationships (SINTEF ref. [5] [6]). After entering the number of the selected dataset, using the right mouse button, the failure rate is loaded into the worksheet. Once the entry of the reliability data and the other variables (mission time, MTBT, MTTR, etc) is completed, it will be possible to activate the processing of the Fault Trees. An example of the fault trees is shown in Figure 6. The MCS are visible both in detail, with highlighting of the sequences relating to the unavailability of components in stand-by, and as equations. The representation is shown in §3.2, Figures 7 and 8. 141 Figure 5: example of "Affidab" sheet Figure 6: Example of Fault Tree 3. Criteria for calculating reliability 3.1 Equations Conceptually, the events sequence described in the HazOp can be represented by a set of equations of the following type. (1) Where: Eλ = λ-th effect Ci = i-th cause of the λ-th effect EAj,j = j-th event of the i-th cause. Equation (1) should be read as: "the Event λ-th takes place by the L causes Ci if for each of them Mi concauses EAi, j occur, with an expected frequency equal to the sum of the expected frequencies of the L causes, each multiplied by the probability of the Mi contributing causes." In other words the summations correspond to OR logic gates, while the multiplications correspond to AND logic gates. The expression is thus both in terms of qualitative illustration and in quantitative terms of the phenomenon. Substituting the equations of the Effects into the Causes give rise to general equations of the type:   = = =   L i M j jii i EACE 1 1 , 142 (2) Where EEi = i-th elementary event or Ci Each term in the first sum of the equation (2), is a Minimal Cut Set (MCS), i.e. the contribution of each elementary cause to the final Top Event. It should also be considered that the adopted HazOp drafting mode does not require a standard Boolean analysis of the Fault Tree. In fact, the elementary events (EE) appear only and always as expected frequency (unit of measure occ/year or event/year), while safety measures appear always as unavailability (unit of measure is dimensionless, i.e. probability). The software is typically used for the estimation of frequencies derived from sequences of events, but may also represent single event resulting from a single cause such as, for example, the rupture of a pipe. Given the variability of the units of measure for the base failure rates in the various technical reference and given the multiplicity of possible situations, the convention to represent the Top Event with an annual frequency, and the unavailability as probability is assumed. Given: f = expected frequency [occ/y] L = pipe length [m] MT = Mission Time or working time in the year [h/y] MTBT = Mean Time Between Test [h] MTTR = Mean Time To Repair [h/occ] N = occ/year or number of operations for each of which an error can potentially occur P = probability [-] PFD = probability of failure on demand [p] λ = base failure rate [occ/h] or [occ/(h·m)] or, in case of pipes (3) If the base failure rate is provided in probability or PFD then: (4) For human errors frequency can be calculated considering the possibility of errors, so (5) In case of unavailability or PFD a distinction has to be made between systems on stand-by mode and systems whose failure is autodetected (such as control loops whose failure automatically causes a deviation of controlled parameter or other parameters, or in the case of a pump stop, which results in the lack of flow). In case of stand-by components (typically switch systems): which for λ·MTBT<0,1 approximates to (6) For events whose failure autodetects: (7) (here also time of detection TR – in hours – can be taken into consideration) In case of redundant systems composed of identical items (no common causes of failure, to be considered separately) which failure doesn't auto detect, the calculation is performed by: (8) Where: m = number of components required for the operation, n = number of components existing in the system r = n-m+1 3.2 Minimal Cut Set (MCS) The user can choose whether to calculate the MCS as well or only the Fault Trees. AlbatrosIII allows to obtain the MCSs for each identified Top Event, by providing a summary of the causes (elementary events) with the percentage contribution of each MCS to the frequency of Top Event, as illustrated below. ji L i M j O l kl N k jki i kj EAEEEETE , 1 1 1 , 1 ,   = = ==         =   𝑓 = 𝜆 ∙ 𝑀𝑇 𝑓 = 𝜆 ∙ 𝑀𝑇 ∙ 𝐿 𝑓 = 𝑝 ∙ 𝑀𝑇 𝑀𝑇𝑇𝑅 𝑓 = 𝑝 ∙ 𝑁 𝑃𝐹𝐷 = 1− 1−𝑒−𝜆∙𝑀𝑇𝐵𝑇 𝜆∙𝑀𝑇𝐵𝑇 𝑃𝐹𝐷 = 𝜆 ∙ 𝑀𝑇 ∙ 𝑀𝑇𝑇𝑅 + 𝑇𝑅 8760 PFD= n! 𝑟!∙ n-r ! ∙ 𝜆∙𝑀𝑇𝐵𝑇 𝑟 𝑟+1 𝜆 𝑀𝑇𝐵𝑇 2 143 Figure 7: MCS equation It is possible to explain the contribution of each of the events that lead up to the Top Event, providing a useful tool for cost / benefit evaluation and ranking of combined events that can cause system failure. Furthermore, in the detailed representation, AlbatrosIII supplies the average PFD of the "AND Events " (safety measures), and their number (corresponding to the number of barriers or components that must fail to cause the undesired occurrence). In this way there is also the representation of the safety level, i.e. of the barriers provided to stop the sequence of dangerous events. The example of the representation of MCS is reported in Figure 8. Figure 8: Breakdown of the MCS 4. Conclusions The AlbatrosIII software allows the drafting and development of the HazOp analysis from which, through the choice and input of failure rates or error probabilities collected in a dedicated database, it is possible to automatically obtain the Fault Trees for the identified Top Events. With a detailed application of the HazOp, also considering the potential failure modes, the program allows the identification of the SIL (Safety Integrity Level - EN IEC 62061) or PL (Performance Level - EN ISO 13849-1) even of complex systems, such as DCS or PLC. In the field of reliability and in the major accident risk analysis sector, this allows integration between risk analysis techniques with considerable time savings. References Antonello F., Buzzi G. (Bari 2009) Albatros II – un programma “user-friendly” per HazOp - Fault Tree quantificati e MCS. Convegno scientifico nazionale “Sicurezza nei Sistemi Complessi” Lihou D.A. (1980) Efficient Use of Operability Studies. Safety Promotion and Loss Prevention in the Process Industries Lihou D.A. (1980) Fault Trees from Operability Studies. Safety Promotion and Loss Prevention in the Process Industries Piccinini N. et al. (2002) How to avoid the generation of loops in the construction of fault trees. Reliability and Maintainability Symposium Proceeding IEEE, vol. 2. SINTEF PDS Method Handbook (2013) Reliability Prediction Methos for Safety Instrumented System. SINTEF PDS Example collection (2010) 144 41zenier.pdf ALBATROS III: an Integrated Software to Obtain the Fault Tree, SIL Level and MCS from the Hazop