During process hazards analyses it is common to hear phrases such as, "Double contingency doesn't count, you know". What the speaker means is that only single failures should be considered when determining what could go wrong and how risk can be managed. But statements on these lines miss the point that most serious incidents are at least double contingency, i.e., two or items or actions have to fail at the same time for the event to take place.
A hazards analysis team may be discussing "High Pressure in Vessel V-101" (the second standard example in Process Risk and Reliability Management). The causes of high pressure could include external fire, blocked-in discharge pump, and chemical reaction. The consequences and likelihoods of each for each of these causes can be assessed and a risk ranking provided for them. No other factors are considered.
But the reality is that there are almost always other factors to consider. Catastrophic events rarely have just one cause, and there are often multiple safeguards to control the event once it is in progress.
At the very least the normal instrumentation supplemented by the attention of the operating personnel will make these events at least triple contingency. In Fault Tree terms:
- IF the pump discharge pressure rises because the pump is blocked in (the initiating event)
- AND IF the normal instrumentation fails to respond
- AND IF the operator does not take action
- AND If the safety instrumented system does not take over
- AND IF the pressure safety relief valve does not open
- THEN the vessel will explode
The sketch shows the corresponding Fault Tree AND Gate.
. . . . .