Marvin Rausand - Risk Assessment

A failure may occur in many different ways, and these are referred to as failure modes .

The manner in which a failure occurs, independent of the cause of the failure.

Reconsider the pump in Example 2.5. The following failure modes may occur:

No output (the pump does not supply any water)

Too low output (i.e. the output is less than 60 l/min)

Too high output (i.e. the output is more than 65 l/min)

Pump does not start when required

Pump does not stop when required

Pump starts when not required…more failure modes depending on other functional requirements: for example, related to power consumption or noise.

Failure mode is a very important concept in risk and reliability analyses and is further discussed in Section 10.5 .

Technical failures do not occur without a failure cause, defined as:

Set of circumstances that leads to failure (IEV 192‐03‐11).

A failure cause may originate during specification, design, manufacturing, installation, operation, or maintenance of an item.

Some of the possible failure causes are classified as failure mechanisms and are defined as follows:

Physical, chemical, or other process that leads to failure.

The pump in Example 2.5may, for example, fail due to the failure mechanisms corrosion, erosion, and/or fatigue. Failure may also occur due to causes that are not failure mechanisms. Among such causes are operational errors, inadequate maintenance, overloading, and so on.

Failures of an item can be classified in several ways. Here, we suffice by mentioning one classification. The classification is related to a specified function of the item and not the hardware as such. To illustrate the different types of failure, we may consider the function “wash clothes” of a washing machine.

Primary failure. These failures occur in the normal operating context of the item and are typically hardware failures caused by some deterioration, such as wear. Primary failures are random failures where the probability distribution is determined by the properties of the item. Primary failures are in some applications called random hardware failures.

Secondary failure. These failures are also called overload failures. A secondary failure of a washing machine may, for example, be caused by a lightning strike or a far too heavy load. Secondary failures are often of a random nature, but the probability distribution has little to do with the properties of the item.

Systematic failure. These failures occur because of a dormant systematic fault of the item (e.g. software bug, maintenance error, and installation error). The systematic failure occurs when a specific demand for the item occurs. The demands may be of a random or nonrandom nature. The first author of this book has experienced persistent software bugs in his washing machine, causing the washing program to abort.

Input/output failures. These failures occur because the required inputs or outputs to the item function are missing or wrong. The inputs to a washing machine consist of electricity, water, detergent, and mobile phone signals (on brand new machines). Output is dirty water to the sewage. The function of the machine is failed when one of these inputs/outputs are missing or deviating from required values. The input/output failures may be random or nonrandom.

Deliberate failures. These failures are nonrandom and occur when a threat actor (also called attacker) uses a physical or cyber threat to harm the item. For some systems, cyber threats may lead to physical harm to assets. A physical threat action is also called a sabotage.

The cruise ship Viking Sky with 1373 passengers and crew aboard narrowly escaped a major accident on 23 March 2019, when her engines failed during a severe storm. The ship drifted rapidly toward the coast of mid‐Norway in very rough waters, but was finally saved by the anchors less than 100m from land. All engines tripped almost at the same time because of a low‐level signal from the level transmitters in the lubrication oil tanks. This system is installed to protect the engines from being destroyed if the lubrication is lost. The level of oil was not critically low, but the heavy seas probably caused movements in the tanks that fooled the level transmitters. The (preventive) shutdown of the engines was therefore a typical systematic fault, caused by a specification or design error of the lubrication oil tanks and/or the placement of the level transmitters. If not modified, the same engine shutdown will reoccur the next time the ship meets the same weather conditions.

For more details about failures and failure classification, see Rausand et al. (2020).

This section has defined a number of commonly used terms in risk assessment. The purpose is to establish a terminology that helps to describe different elements of the problem being addressed in a risk analysis. Unfortunately, as stated already, terminology is a problem within this field. Therefore, we once more warn the reader about the use of these terms in other documents, reports, standards, and scientific publications.

All the terms defined in this section are used in different ways by different authors. In particular the terms “hazard,” “initiating event,” and “hazardous event” are used in many different ways compared to how it has been defined here. Hazard is often used to encompass both hazardous events and enabling events and conditions. Hazard then becomes a term that covers more or less anything that either are events in accident scenarios or conditions that can influence the development of those scenarios. This may be sufficient in some cases, but we see that it can cause confusion and result in an unstructured process to identify what can go wrong. Our opinion is therefore that it is important to have precise definitions. To illustrate the above, an example of what a checklist for hazard identification can look like is shown in Table 2.5. If this list is compared to the definitions, it contains both hazards, enabling events and enabling conditions.

Table 2.5Generic hazard list (not exhaustive).

To add to the confusion, several other terms are used that overlap our terms, but often without a clear definition. Examples include accident initiator, accident initiating event, accidental event, critical event, undesired event, unwanted event, process deviation, and potential major incident (accident).