# Fuzzy Risk Graph Model for Determining Safety Integrity Level

Authors: R. Nait-Said; F. Zidani; N. Ouzraoui
Journal: International Journal of Quality, Statistics, and Reliability
 (2008-01-31)

---

## Abstract

The risk graph is one of the most popular methods used to determine the safety integrity level for safety instrumented functions. However, conventional risk graph as described in the IEC 61508 standard is subjective and suffers from an interpretation problem of risk parameters. Thus, it can lead to inconsistent outcomes that may result in conservative
SIL's. To overcome this difficulty, a modified risk graph using fuzzy rule-based system is proposed. This novel version of risk graph uses fuzzy scales to assess risk parameters, and calibration may be made by varying risk parameter values. Furthermore, the outcomes which are numerical values of risk reduction factor (the inverse of the probability of failure on demand) can be compared directly with those given by quantitative and semiquantitative methods such as fault tree analysis (FTA), quantitative risk assessment (QRA), and layers of protection analysis (LOPA).


---

## Body

## 1. Introduction

The purpose of a safety analysis is to
ensure that the risks that could be a potential source of harm, damage of
property and degradation of the environment, are sufficiently minimized by
addressing all the relevant safety lifecycle stages including the design,
implementation, operation, and maintenance through to decommissioning. Reducing
residual risk to an acceptable level is usually achieved by using a combination
of safety protective systems, including safety instrumented systems, SIS (e.g.,
emergency shutdown systems and fire and gas systems), other technology
safety-related systems (e.g., relief valves, bursting discs, firewalls, drain
system), and external risk reduction facilities (e.g., work organization, procedures,
separation). The
SIS often represents an integral part of a
safety management system to reduce the risk of major accident hazards [1]. It is made up of one or
more safety instrumented functions (SIF) to sense
abnormal situations and automatically return the process to a safe state.
This is usually achieved by performing a partial or complete shutdown of the
process, to prevent a hazardous event or mitigate its consequences. If the
initial risk without SIS is high, the availability and integrity requirements
for SIF's must be high.Requirements for SIF's
are addressed in the international standard IEC 61508 [2] and the
process industry sector-specific version  IEC 61511 [3] which are widely accepted as
the basis for specification, design, and operation of SIS's. Each SIF is
specified in terms of the action to be achieved and the required probability of
failure on demand (PFD). The latter defines the required safety integrity level
(SIL) for the SIF. The IEC standards provide a framework for establishing SIL's
although they do not specify the SIL's required for specific applications. They
propose various methods for determining the PFD or the amount of risk reduction
needed.The risk graph described in Part 5 of the IEC 61508 is one of the most
popular methods that enables the SIL of a SIF to be determined from a knowledge
on the risk factors related to the process. In particular, it has been
extensively applied when determining SIL requirements for local safety
functions such as process shutdown systems [4, 5]. The principles of the risk
graph method have been adopted in the UKOOA guidelines for process control and
safety systems on offshore installations and other documents published by
offshore operators [6, 7].An important
issue faced by risk analysts is how to deal with uncertainties that arise in
each phase of the risk assessment process. In particular, one should identify
how to deal with the state ofincomplete/no knowledge related to process
safety functions. An underlying assumption is that uncertainty increases
risk, but this is a conservative approach requiring that, in the absence of
meaningful data or the opportunity to assimilate all available data, risk
should be overestimated rather than underestimated. Therefore, higher ratings are assigned to
risk parameters, reflecting the assumption of unfavorable conditions, in order
to compensate the uncertainty. Although this approach results in a conservative
outcome leading to a design of sufficient safety integrity, it leads also to higher
installation and maintenance costs. Alternatively, more efforts are certainly
needed to obtain a consistent and less conservative outcome using more refined
SIL determination methods [4, 8, 9].Fuzzy rule-based systems and fuzzy arithmetic [10–12] have emerged
over the last years as a very appropriate tool in dealing with uncertainty in
reliability and safety analysis [13–18]. In this paper, an approach of fuzzy
rule-based risk graph is proposed in order to add more power features to the conventional
calibrated risk graph method. In this perspective, the safety integrity
assessment based on fuzzy logic allows the analyst to evaluate the SIL of SIF's
in a natural way by using the notion of a linguistic variable for depicting
information which is qualitative, imprecise, and/or uncertain. The methodology
we have used is the application of the fuzzy inference system with fuzzifier
and defuzzifier on a calibrated risk graph. The outcomes of the fuzzy risk
graph are numerical values of risk reduction factor (RRF = 1/PFD) which are
computed from a defuzzification of fuzzy SIL's.


## 2. Conventional Risk Graph Method

Safety-related systems are conceived to implement the safety functions
necessary to achieve or maintain a safe state for the process in terms of
specified risk reduction related to hazardous events. A safety function is thus
expressed in terms of the action to be taken and the required probability to
satisfactorily perform this action. This probability as a quantitative target
defines the safety integrity. Four discrete safety integrity levels, namely,
SIL1, SIL2, SIL3, and SIL4, are defined in the IEC 61508, and quantitative
targets to which they relate are based on whether the safety-related system is
operating in low-demand mode (e.g., shutdown system) or continuously (e.g.,
motor care brakes). In the first case, the appropriate measure of safety
function performance is the probability of failure on demand (PFD), or its
inverse, risk reduction factor (RRF). For functions which operate continuously,
it is the probability of a dangerous failure per hour which is of concern. Table1 shows the definition of the four SIL's for low-demand mode. As shown, the
higher the SIL is, the more available the safety related system will be, so the
more stringent becomes the implementation of safety function.Table 1
Definition of SIL's for low-demand mode from IEC 61508-1.
SILRange of average PFDRange of RRF4[10−5,10−4[]104,105]3[10−4,10−3[]103,104]2[10−3,10−2[]102,103]1[10−2,10−1[]101,102]For determining the SIL, IEC standards have provided various methods that
have been applied with differing degrees of success [4]. These methods range
from using pure quantitative risk assessments to more qualitative methods, as
follows:(i)
quantitative methods such as fault
tree analysis (FTA) and layer of protection analysis (LOPA),(ii)
semiqualitative methods such as
safety layer matrix and calibrated risk graph. The latter is described by some
practitioners as a semiquantitative method,(iii)
qualitative methods like risk graph and hazardous event severity
matrix.
Qualitative and
semiqualitative methods are generally less costly than the quantitative ones.
They are technologically less demanding to develop, relatively intuitive to
plant operators without requiring detailed risk assessment training, and do not
make extensive use of historical failure-related data as a base of estimating
failure probabilities.The risk graph as a qualitative method can be described as a decision
tree in which four risk parameters, considered to be sufficiently generic to
deal with a wide range of applications, must be combined to arrive at the
required SIL. These parameters are as follows: consequence (Ci),
frequency and exposure time (Fj), possibility of avoiding
hazard (Pk), and probability of the unwanted occurrence (Wl).
Figure 1 gives an example of a risk graph implementation [2]. An explanation of
this risk graph is the following.Figure 1
Example of risk graph from IEC 61508-5.(i)
Use of the risk parametersC, F,
and P leads to one of six outputs X1,X2,…,X6.
Each one of these outputs is mapped onto one of three scales (W1, W2, and W3). Each point on these scales
gives an indication of the necessary safety integrity that has to be met by the
E/E/PE safety-related system. The numbers 1, 2, 3, and 4 represent the four
SIL's. The point a indicates the case of a system without special safety
requirements, which corresponds to a probability of failure less than that indicated for SIL1.
The point b refers to situations when for specific consequences, a
single safety-related system is not sufficient to give the necessary risk
reduction.(ii)
The mapping ontoW1, W2,
or W3 allows the contribution of other risk reduction
measures to be made. Scale W3 provides the minimum risk
reduction contributed by other measures (i.e., the highest probability of the
unwanted occurrence), scale W2
is a medium contribution, and scale W1 is the maximum contribution. Thus, the output of the risk graph as a measure of
the required risk reduction for the E/E/PE safety-related system, together with
the risk reductions achieved by other technology safety related systems and
external risk reduction facilities which are taken into account by the W1 scales, gives the overall risk reduction for the specific situation.


## 3. Shortcomings and Alternatives

Although the risk graph method is relatively easy to
be implemented and allows a fast assessment of SIL's, it is less precise.
Indeed, the interpretation of linguistic terms such asrare, possible,
and death of several persons, can differ between evaluators since
they could be the result of a subjective decision or can differ from one industry sector to
another [4, 6, 19].There is therefore the need to calibrate the graph and to give guidance
on the meanings of linguistic terms using orders of magnitude via numerical
scales so that the resulting SIL rating will bring down the residual risk to the
acceptable level. Otherwise, the risk reduction will be principally subjective
with substantial limitations for safety-related decision making [20]. In this sense,
the IEC 61511 Part 3 provides a semiqualitative method which is the calibrated
risk graph. Although not specifically and absolutely fixed by the standard, the
risk graph is usually calibrated such that each decision differs from another
by a factor of ten (10−1,10−2,…). Figure 2 and Table 2, respectively, show an
example of a risk graph as used in the UKOOA guidelines and quantitative
definitions of risk parameters [6, 7, 21].Table 2
Example of qualitative and quantitative definitions of parameters.
Risk parametersQualitative descriptionsQuantitative descriptionsConsequence (C)Minor injuryNo deaths per eventMarginal:
one death or permanent injury]10−2,10−1] probable deaths per eventCritical:
several deaths]10−1,1] probable
deaths per eventCatastrophic:
many deaths>1 probable
deaths per eventExposure (F)Rare<10% of timeFrequent≥10% of timeAvoidance (P)Possible>90% probability
of avoiding hazardNot likely≤90% probability
of avoiding hazardDemand rate (W)Very low<1 in 30 years≈
<0.03 per yearLow1 in]3,30] years ≈[0.03,0.3[ per yearRelatively high1 in]0.3,3] years ≈[0.3,3[ per yearFigure 2
Risk graph with qualitative description of parameters.Against a tolerable target risk, managing the inherent uncertainty in the
range of the risk parameters of a risk graph is problematic [7, 21, 22].
Although crisp intervals as means of characterizing uncertainty are an
acceptable part of the usual calibrated risk graphs, the sufficient robustness
in the SIL value may not be reached against the ambiguity of the information
upon which the assessors base their judgment.This type of knowledge
elicitation presents two major disadvantages: first, it is in discordance with
the gradual transition from one interval to another, well known in real world
applications. Indeed, a measurement that falls into a close neighborhood of
each precisely defined border between two adjacent intervals is taken as an evidential
support for only one of them, in spite of the inevitable uncertainty involved
in the computing of the SIL, that is, the safety integrity will be more or less
one with of course different requirements. Second, it fails to reflect the fact
that in most human reasoning and concept formation, the decomposition of whole
into parts is fuzzy rather than crisp [23–25]. In fact, there is an
incompatibility between the uncertainty characterizing human perception and the
crispness of the response mode. Thus, we need a representation of numbers,
which is tolerant of imprecision and partial truths. Linguistic terms, defined on numerical
universes and supported by fuzzy sets, provide a rather natural tool for
numeric/symbolic interfaces and would be a very adequate alternative when
available information is imprecise and/or uncertain.Furthermore, compared toC and W parameters, F and P have only two ranges each and so the calibration will be dominated by the two
first. As an alternative solution, Blackmore [22] developed for an offshore
project an alternative graph format by introducing four categories for F against reducing those of C to two only (injury or death). As
reported, the proposed approach has resulted in improved effectiveness in the
SIL determination. For a best calibration, Dean [7] suggested also the
introduction of additional consequence and frequency bands in some cases.
Recently, Baybutt [8] has developed an improved risk graph with the following
four parameters: initiating cause frequency, enabling events/conditions,
safeguards failure probability, and consequences of the hazardous event. He
introduces more than two levels for the first and the last two parameters to overcome both
conservative and optimistic choices that respectively may result in an
overestimation and underestimation of the SIL.Another alternative proposed by Ormos
and Ajtonyi [26] concerns the use of a fuzzy
rule-based system in determining the SIL value by applying hazardous event
severity matrix and conditional catastrophe theory. By application to three
subsystems of steam production, the results of this approach compared with
those provided by the quantitative method (as described by the IEC 61508) are
very encouraging. For two subsystems the same result is obtained, SIL3 and SIL2, and for the third the result is SIL1 by fuzzy approach against SIL2 by the
quantitative method. This difference is interpreted by the fact that severity
parameter qualitatively estimated as low is not taken into consideration by the
quantitative method. In the same way, Simon et al. [27] propose a fuzzy
rule-based approach of the risk graph as well as a subjective evaluation of risk
parameters by aggregation of expert judgments. Allocation of required SIL is
determined by considering the risk graph as a fuzzy decision tree. Both risk
parameters and SIL are represented by fuzzy partitions with linguistic
descriptors, defined on ordinal measurement scales. The proposed approach is
applied to equipment issued from the literature: a vessel containing a volatile
flammable liquid. A SIF is considered to protect against a gas release greater
than the admissible rate which is 10−4 per year. Each risk parameter
is assessed by aggregating expert judgments given as possibility distributions,
and fuzzy inference system provides after difuzzification the SIL value which
is SIL2. Referring to these works, we attempt in this paper to develop a more
flexible calibrated risk graph using fuzzy logic system, with two main
differences compared to the above approaches. First, calibration problem is
taken into consideration, and so, scales supporting fuzzy partitions of the SIL
and parameters C, F, P, and W are numeric rather
ordinal with the orders of magnitude given by Tables 1 and 2. Second, fuzzy
intervals defined on the RRF universe particularly allow a SIL value to be
between two successive classes with differing membership degrees. In practice, when
the availability data for a SIF indicates a requirement just between two
SIL classes, generally the stricter SIL requirement is chosen [5]. This
conservative solution involves a more substantial increment of effort and
competence with the major difference occurring when moving from SIL2 to SIL3
[6]. The fuzzy integrity levels may be an alternative to resolve this kind of
problems. For example, a value of RRF (1/PFD) as an outcome of the fuzzy risk
graph model may belong simultaneously to two fuzzy sets SIL2 and SIL3 but with a little higher membership degree to the latter (e.g., equal to 0.7).
It would be reasonable to say that we are in presence of rather SIL3 requirements which clearly involve less cost and time than conventional SIL3,
according to the proportion given by the membership degree. For example, 70% of
the cost and time devoted to the conventional SIL3.


## 4. Fuzzy Inference System Methodology

Fuzzy logic-based method is a powerful tool for modeling the behavior of
systems which are too complex or too ill-defined to admit of conventional
quantitative techniques or when the available information from the systems is
qualitative, imprecise, and/or uncertain. In contrast to classical logical
systems, fuzzy logic aims at modeling the imprecise modes of reasoning that
play an essential role in the human ability to give judgments or to make
decisions in an environment of uncertainty and imprecision. Thus, unlike
quantitative approaches that require accurate equations to model real-world
behaviors, fuzzy logic can accommodate the ambiguities of real-world human with
the concept of fuzzy sets and fuzzy inference techniques and consequently,
possess a natural capability to express and deal with judgment and measurement
uncertainties.Fuzzy inference systems have found numerous applications in fields such
as automatic control, data classification, decision analysis, expert systems,
reliability engineering, and system safety. Among these systems, the fuzzy
logic controller proposed by Mamdani and Assilian [28] is the most encountered
in fuzzy rule-based problems. It was the first implementation dedicated to the
control of a steam engine by synthesizing a set of fuzzy rules provided by
experienced human operators. Based on a simple technique using the max-min
inference, Mamdani’s method has been successfully applied in many fields
ranging from processes control to medical diagnosis. Specific details for each
step of this method are explained briefly below [29].Let us consider
a rule base constituted ofn fuzzy IF-THEN rules with multiple inputs
and single output (MISO). Each rule Ri(i=1,…,n) is therefore of the form(1)Ri:ifX1isAi1and…andXmisAimthenYisBi, where the Xj's, j=1,…,m,
and Y are linguistic variables defined on the
universes U=U1×…×Um and V,
respectively. The fuzzy sets Aij are elements of a linguistic partition Tj of Uj (universe of variable Xj). For a crisp input vector u0=(u10,…,um0),
the output value is determined by the following three-step method.


### 4.1. Fuzzification

It is the
process of converting an input datauj0 into its symbolic representation, that is, a
fuzzy set Aij*, using the fuzzy partition Tj of Uj, by computing the membership degree
μAij(uj0) of uj0 to each Aij. Then, a matching degree αi=minjμAij(uj0) is computed for each rule Ri.


### 4.2. Fuzzy Inference

The process for
obtaining the fuzzy output using the max-min inference method consists of the
following substeps.(i)
Finding the firing
level of each rule: the truth value for the premise of each ruleRi is computed and applied to the conclusion part
of this rule. It is computed as follows:
(2)αi=minjμAij(uj0). If a rule’s
premise has nonzero degree of truth, that is, when the input matches partially
the premise of the rule, then the rule is fired.(ii)
Inferencing: in the inference
step, the outputBi' of each rule Ri is computed using a conjunction operator, the min.
Then, Bi'=αi∧Bi is given by
(3)μBi'(v)=min(αi,μBi(v)).(iii)
Aggregation: for obtaining the
overall system output, all the individual rule outputs are combined using the
union operator. Then,B′=⋃iBi'=⋃iαi∧Bi with membership function
(4)μB′(v)=maxi=1,…,nμBi'(v).


### 4.3. Defuzzification

It produces a
representative valuev0 of Y in B′.
Among defuzzification methods, the center of gravity is the most commonly used,
and it is given by(5)v0=∫v∈VμB′(v)⋅v⋅dv∫v∈VμB′(v)⋅dv.


## 4.1. Fuzzification

It is the
process of converting an input datauj0 into its symbolic representation, that is, a
fuzzy set Aij*, using the fuzzy partition Tj of Uj, by computing the membership degree
μAij(uj0) of uj0 to each Aij. Then, a matching degree αi=minjμAij(uj0) is computed for each rule Ri.


## 4.2. Fuzzy Inference

The process for
obtaining the fuzzy output using the max-min inference method consists of the
following substeps.(i)
Finding the firing
level of each rule: the truth value for the premise of each ruleRi is computed and applied to the conclusion part
of this rule. It is computed as follows:
(2)αi=minjμAij(uj0). If a rule’s
premise has nonzero degree of truth, that is, when the input matches partially
the premise of the rule, then the rule is fired.(ii)
Inferencing: in the inference
step, the outputBi' of each rule Ri is computed using a conjunction operator, the min.
Then, Bi'=αi∧Bi is given by
(3)μBi'(v)=min(αi,μBi(v)).(iii)
Aggregation: for obtaining the
overall system output, all the individual rule outputs are combined using the
union operator. Then,B′=⋃iBi'=⋃iαi∧Bi with membership function
(4)μB′(v)=maxi=1,…,nμBi'(v).


## 4.3. Defuzzification

It produces a
representative valuev0 of Y in B′.
Among defuzzification methods, the center of gravity is the most commonly used,
and it is given by(5)v0=∫v∈VμB′(v)⋅v⋅dv∫v∈VμB′(v)⋅dv.


## 5. Fuzzy Safety Integrity Assessment

The overall procedure for making a fuzzy safety integrity assessment is
shown in Figure3. The analysis uses fuzzy partitions to describe both risk
parameters and SIL's. The membership functions are determined by a
fuzzification, that is, a fuzzy information granulation according to Zadeh [25],
of data of a typical calibrated risk graph. Thus, crisp intervals are replaced
by fuzzy intervals with trapezoidal membership functions. The basic idea of this
transformation is to consider the boundaries of an ordinary interval as a mean
value of a fuzzy number under the form of upper and lower expectations [30].
Details concerning the different steps of the proposed fuzzy model are presented
bellow.Figure 3
Overall procedure of fuzzy safety integrity
assessment.


### 5.1. Selection of Input Variables

Referring to the
IEC standards, the fuzzy rule-based system associated with conventional risk
graph considers the four risk parametersC, F, P, and W as input variables, and considers the SIL as the unique output variable. The
parameters C, F, P, and W allow a meaningful
graduation of the risks to be made, and contain the key risk assessment factors.
Obviously, other factors or conditions could be considered but with reduced
number because two major disadvantages may emerge. First, the higher the number of parameters is, the more additional
SIL's should be necessarily added but certainly without corresponding
requirements. Second, further input variables do not allow the fuzzy system to
be at a reasonable size and may complicate the test of the model.


### 5.2. Development of the Fuzzy Scales

Fuzzy logic uses the concept of linguistic variable to describe the
premise and conclusion of a fuzzy rule [11, 12]. This concept provides a tool of
approximate characterization of situations which are too complex or too
ill-defined for the application of conventional quantitative techniques. A
linguistic variable differs from a numerical variable in that its values are
not numbers but words in a natural language. The fuzzy sets, with their boundaries
not sharply defined, play the role of values of the linguistic variable and may
be viewed as summaries of various subclasses of elements in a universe of
discourse. In the present step, the fuzzy sets for the description of the
parameters C, F, P, and W and the SIL are derived
from corresponding crisp partitions, referring to an experienced model, the calibrated
risk graph presented in Figure 2. Transforming an ordinary interval to a fuzzy
interval may be considered as the converse problem of determining the mean
value of a fuzzy interval. However, consistently with the well-known definition
of expectation in probability theory, Dubois and Prade [30] have suggested a
relevant definition of the mean value of a fuzzy interval as follows: “the mean
value of a fuzzy interval Q is a closed interval bounded by the
expectations calculated from its upper and lower distribution functions,” that
is,(6)E(Q)=[E*(Q),E*(Q)], where(7)E*(Q)=infE(Q)=∫−∞+∞udF*(u),E*(Q)=supE(Q)=∫−∞+∞udF*(u).F* and F* are the lower and upper distribution functions
of P,
respectively, and P belongs to the set of probability measures, 𝒫(Q), which are defined on the
support of Q. Let Q be
a fuzzy interval with a trapezoidal membership function μQ,
and let S(Q)=[s−,s+] and C(Q)=[q−,q+] be the support and core of Q, respectively, that is, μS(Q)(u)>0 and μC(Q)(u)=1.
Let α and β be called the left and right spreads, respectively.
Under the condition limx→−∞ukF(u)=limx→+∞uk(1−F(u))=0 for k≥1,
it follows that(8)E*(Q)=∫0+∞(1−F*(u))du−∫−∞0F*(u)du=q−−∫−∞q−μQ(u)du,E*(Q)=∫0+∞(1−F*(u))du−∫−∞0F*(u)du=q++∫q++∞μQ(u)du. The calculation of E*(Q) is as follows (see Figure 4):Figure 4
Upper and lower mean values ofQ.(9)E*(Q)=q−−∫−∞q−μQ(u)du=q−−∫−∞q−(1−q−−uα)du=q−−∫s−q−(1−q−−uα)du=q−−[(1−q−α)u+u22α]s−q−=q−−α2. Thus,(10)E*(Q)=q−−α2,(11)E*(Q)=q++β2. These results are in concordance with the
fact that the width of the mean value is a linear function of the spreads α and β [30]. In our case, given E* and q− (resp., E* and q+) of an unknown fuzzy interval Q, α (resp., β) will be determined using (10) (resp., (11)). E* and E* as mean values are given by the boundaries of
crisp intervals. The calculation of α and β is as follows. First, one computes the mean
value, m, of the interval [E*,E*].
Next, the core boundaries, q− and q+,
are computed using the mean value of the subdivisions [E*,m] and [m,E*],
respectively. Both for m, q−,
and q+,
one uses either arithmetic mean or geometric mean according to whether or not
the universe scale is linear. Figure 5 illustrates
the transformation of an ordinary interval into a fuzzy one on a linear scale.
For instance, α and s− are determined as follows:Figure 5
Transformation of a crisp interval into a fuzzy
one.(12)α=2(q−−E*)=2(E*+m2−E*)=m−E*=E*+E*2−E*=E*−E*2,s−=q−−α. Extreme fuzzy sets within a linguistic
partition are derived from the transformation by assuming infinite spreads, that
is, taking α=−∞, μQel(u)=1 for u≤q− and β=+∞, μQer(u)=1 for u≥q+ (el is for extreme left and er for extreme right). Furthermore, transforming an irregular crisp partition into
a fuzzy partition may involve linguistic labels with meaningless values
(incompatibility problem). In this case, the slope of the increasing or decreasing part of these
fuzzy sets needs to be reasonably modified. Table 3 shows numerical results of
the different transformations based on data of Tables 1 and 2. The
transformation concerning the parameter consequence is illustrated by Figures
6(a), 6(b), 6(c), 6(d). The fuzzy partitions of risk parameters and SIL, which are
derived from the fuzzy intervals Q=[q−,[s−,s+],q+],
are given by Figures 7(a), 7(b),
7(c), 7(d) and 8. A more detailed description of these partitions is presented in the following:Table 3
Transformation of crisp intervals into Fuzzy intervals.
Transformation indicesLower mean valueUpper mean valueGeometric mean of[E*,E*]Lower boundary
of the coreC(Q)Upper boundary
of the coreC(Q)Left spread ofQRight spread ofQLower boundary
of the supportS(Q)Modified value
ofS−Upper boundary
of the supportS(Q)Modified value
ofS+SymbolsE*E*mq−q+αβS−S−*S+S+*ConsequenceMinor1.0E-091.0E-071.0E-083.162E-093.162E-084.325E-091.368E-07−1.162E-091.0E-091.684E-07—Moderate0.010.13.162E-021.778E-025.623E-021.557E-028.753E-022.217E-03—1.438E-01—Critical0.113.162E-011.778E-015.623E-011.557E-018.753E-012.217E-02—1.438E+00—Catastrophic1103.162E+001.778E+005.623E+001.557E+008.753E+002.217E-01—1.438E+0110ExposureRare0105.0E+002.50E+007.50E+005.0E+005.0E+00−2.50E+0001.250E+01—Frequent101005.50E+013.250E+017.750E+014.50E+014.50E+01−1.250E+017.50E+001.225E+02100AvoidanceNot likely0904.50E+012.250E+016.750E+014.50E+014.50E+01−2.250E+0101.125E+029.250E+01Possible901009.50E+019.250E+019.750E+015.0E+005.0E+008.750E+01—1.025E+02100Demand rateVery low1.0E-020.035.477E-047.401E-054.054E-031.280E-045.189E-02−5.401E-051.0E-055.595E-02—Low0.030.39.487E-025.335E-021.687E-014.670E-022.626E-016.652E-03—4.313E-01—Relatively high0.315.477E-014.054E-017.401E-012.107E-015.198E-011.946E-01—1.260E+001SIL (RRF = 1/ PFD)NSSR (a)1103.162E+001.778E+005.623E+001.557E+008.753E+002.217E-0111.438E+01—SIL1101003.162E+011.778E+015.623E+011.557E+018.753E+012.217E+00—1.438E+02—SIL21.0E+021.0E+033.162E+021.778E+025.623E+021.557E+028.753E+022.217E+01—1.438E+03—SIL31.0E+031.0E+043.162E+031.778E+035.623E+031.557E+038.753E+032.217E+02—1.438E+04—SIL41.0E+041.0E+053.162E+041.778E+045.623E+041.557E+048.753E+042.217E+03—1.438E+05—NR1.0E+051.0E+063.162E+051.778E+055.623E+051.557E+058.753E+052.217E+04—1.438E+061.0E+06Transformation of crisp intervals into fuzzy ones:
case of the parameter consequence:
(a) minor, (b) moderate, (c) critical, and (d) catastrophic.
(a)(b)(c)(d)Membership functions generated for risk parameters
(a) consequence, (b) exposure, (c) avoidance, (d) demand rate.Figure 8
Membership functions generated for SIL.(i)
consequence: four fuzzy
sets, namely, minor, moderate, critical, and catastrophic,
were defined on the input space of this variable (Figure 7(a)). The values
varying from 10−9 to 10 are represented on a logarithmic scale. To
the linguistic value minor defined in risk graph as no deaths is
assigned the crisp interval [10−9, 10−7] which suitably
represents an unlikely event. This interval is transformed into a fuzzy one
with the omission of the negative part. The interval [1,10] is selected to be the mean value of the fuzzy
set catastrophic with the possibility to change its upper bound
according to the hazardous situation. The increasing part of catastrophic is adjusted by taking the upper bound of the core of the fuzzy set critical as its beginning point.  This adjustment has double purpose. First, it removes
the negative part of the fuzzy interval associated with the term catastrophic,
which is meaningless from a point of view of number of fatalities.
Second, it avoids the overlapping between more than two fuzzy sets, which
involves many meaningless values for the class catastrophic. For
instance, the degree of membership of the zero value in the nonadjusted fuzzy
interval is 0.27.(ii)
Frequency and
exposure time: two fuzzy
sets, namely, rare and frequent, were defined on a linear scale
ranging from 0% to 100% (Figure 7(b)). The boundaries of their cores are
derived from arithmetic means of crisp interval subdivisions. As in the
previous risk parameter, the negative part of the first set rare is
removed, and the upper bound of its core has served as a lower bound of the
support of the second set frequent. The membership function of the
latter is obviously right open.(iii)
Possibility of avoiding hazard: as in the previous input
parameter, two fuzzy sets named, not likely and possible, respectively,
were defined on the universe [0,100] (Figure 7(c)). For the first set not likely, the negative part is removed
and the upper bound of its support takes the lower bound value of the core of
the set possible. The values of
the latter are limited to 100 with a right open membership function.(iv)
Probability of the unwanted occurrence: three fuzzy sets,
namely, very low, low, and relatively high, were defined
on a probability space ranging from 10−5 pa to 1 pa (Figure 7(d)). As for the first risk parameter, the
probability values are represented on a logarithmic scale. The choice of 10−5 pa (or 1.14 × 10−9 ph) as a lower bound of the interval [10−5, 0.03] refers to an
unlikely event. Only the first and the last fuzzy sets were adjusted by removing the negative part
and the values greater then one, respectively. The intermediate fuzzy set low is remaining unchanged.(v)
Safety integrity level (SIL): the SIL as a unique output
variable is defined on a RRF scale. The universe of discourse of the latter
consists of the interval [1, 106] with a regular crisp partition, that
is, there is a factor of ten between two successive subintervals. Seven fuzzy
sets were defined on the output space (Figure 8): four sets are associated with
the four SIL's, with the same labels as levels themselves, namely, SIL1, SIL2, SIL3, and SIL4, and the two sets named NSSR and  NR refer to the cases no special safety requirements and single SRS not
recommended, respectively. Except the delimitation of the set NR, no
adjustment is made for all these labels.


#### 5.2.1. Derivation of the Fuzzy Rules

A number of fuzzy IF-THEN rules are extracted following the risk graph
logic and using the linguistic descriptors associated with risk parameters and
SIL. In this case, the rule base can be understood as a translation of the risk
graph which is mainly based on the knowledge and experience of analysts
regarding the process nature and required risk reduction. Both the number of
rules and input variables involved in premise parts depend on the risk graph
implementation, that is, the decomposition level of risk graph. In the premise
and conclusion parts of rules, the linguistic value meaning of input and output
variables are described by the fuzzy sets defined in step 2. The general form
of the derived fuzzy rules is(13)Ri:IFCisAiCandFisAiFandPisAiPandWisAiWTHENSILisBi where the risk
parameters C, F, P, and W stand for input variables; AiC,AiF,AiP, and AiW are their linguistic values, respectively. The SIL is an output variable with Bi as its linguistic value. The fuzzy vector (AiC,AiF,AiP,AiW) and the fuzzy set Bi are elements of the universes URP=UC×UF×UP×UW (RP for risk parameters) and USIL,
respectively. According to the risk graph reduction, the premise part of the
above rule may be reduced to two or three input variables. Referring to the
calibrated risk graph of Figure 2, two examples of fuzzy rules are the
following:(14)IFCisMarginalandFisFrequentandPisPossibleandWisLowTHENSILisSIL2,IFCisCriticalandFisRareandWisLowTHENSILisSIL3


#### 5.2.2. Fuzzy Rule Base Application

As explained in Section4, fuzzy inference system methodology, when the
fuzzy inference system is to be applied to a set of input parameter values, the
information flows through the fuzzification-inference-defuzzification process
in order to generate the output value. Given any combination of input values
which cover the specific context of risk parameters, the fuzzy rule-based risk
graph will compute the RRF value that the SIF must achieve within the specific
context. The fuzzifier maps crisp input vector uRP0=(uC0,uF0,uP0,uW0) in URP to fuzzy sets in URP,
and the defuzzifier maps fuzzy sets in USIL.
If one or more risk parameters are not considered for a given rule, they will not
have any effect on the matching degree αi.


## 5.1. Selection of Input Variables

Referring to the
IEC standards, the fuzzy rule-based system associated with conventional risk
graph considers the four risk parametersC, F, P, and W as input variables, and considers the SIL as the unique output variable. The
parameters C, F, P, and W allow a meaningful
graduation of the risks to be made, and contain the key risk assessment factors.
Obviously, other factors or conditions could be considered but with reduced
number because two major disadvantages may emerge. First, the higher the number of parameters is, the more additional
SIL's should be necessarily added but certainly without corresponding
requirements. Second, further input variables do not allow the fuzzy system to
be at a reasonable size and may complicate the test of the model.


## 5.2. Development of the Fuzzy Scales

Fuzzy logic uses the concept of linguistic variable to describe the
premise and conclusion of a fuzzy rule [11, 12]. This concept provides a tool of
approximate characterization of situations which are too complex or too
ill-defined for the application of conventional quantitative techniques. A
linguistic variable differs from a numerical variable in that its values are
not numbers but words in a natural language. The fuzzy sets, with their boundaries
not sharply defined, play the role of values of the linguistic variable and may
be viewed as summaries of various subclasses of elements in a universe of
discourse. In the present step, the fuzzy sets for the description of the
parameters C, F, P, and W and the SIL are derived
from corresponding crisp partitions, referring to an experienced model, the calibrated
risk graph presented in Figure 2. Transforming an ordinary interval to a fuzzy
interval may be considered as the converse problem of determining the mean
value of a fuzzy interval. However, consistently with the well-known definition
of expectation in probability theory, Dubois and Prade [30] have suggested a
relevant definition of the mean value of a fuzzy interval as follows: “the mean
value of a fuzzy interval Q is a closed interval bounded by the
expectations calculated from its upper and lower distribution functions,” that
is,(6)E(Q)=[E*(Q),E*(Q)], where(7)E*(Q)=infE(Q)=∫−∞+∞udF*(u),E*(Q)=supE(Q)=∫−∞+∞udF*(u).F* and F* are the lower and upper distribution functions
of P,
respectively, and P belongs to the set of probability measures, 𝒫(Q), which are defined on the
support of Q. Let Q be
a fuzzy interval with a trapezoidal membership function μQ,
and let S(Q)=[s−,s+] and C(Q)=[q−,q+] be the support and core of Q, respectively, that is, μS(Q)(u)>0 and μC(Q)(u)=1.
Let α and β be called the left and right spreads, respectively.
Under the condition limx→−∞ukF(u)=limx→+∞uk(1−F(u))=0 for k≥1,
it follows that(8)E*(Q)=∫0+∞(1−F*(u))du−∫−∞0F*(u)du=q−−∫−∞q−μQ(u)du,E*(Q)=∫0+∞(1−F*(u))du−∫−∞0F*(u)du=q++∫q++∞μQ(u)du. The calculation of E*(Q) is as follows (see Figure 4):Figure 4
Upper and lower mean values ofQ.(9)E*(Q)=q−−∫−∞q−μQ(u)du=q−−∫−∞q−(1−q−−uα)du=q−−∫s−q−(1−q−−uα)du=q−−[(1−q−α)u+u22α]s−q−=q−−α2. Thus,(10)E*(Q)=q−−α2,(11)E*(Q)=q++β2. These results are in concordance with the
fact that the width of the mean value is a linear function of the spreads α and β [30]. In our case, given E* and q− (resp., E* and q+) of an unknown fuzzy interval Q, α (resp., β) will be determined using (10) (resp., (11)). E* and E* as mean values are given by the boundaries of
crisp intervals. The calculation of α and β is as follows. First, one computes the mean
value, m, of the interval [E*,E*].
Next, the core boundaries, q− and q+,
are computed using the mean value of the subdivisions [E*,m] and [m,E*],
respectively. Both for m, q−,
and q+,
one uses either arithmetic mean or geometric mean according to whether or not
the universe scale is linear. Figure 5 illustrates
the transformation of an ordinary interval into a fuzzy one on a linear scale.
For instance, α and s− are determined as follows:Figure 5
Transformation of a crisp interval into a fuzzy
one.(12)α=2(q−−E*)=2(E*+m2−E*)=m−E*=E*+E*2−E*=E*−E*2,s−=q−−α. Extreme fuzzy sets within a linguistic
partition are derived from the transformation by assuming infinite spreads, that
is, taking α=−∞, μQel(u)=1 for u≤q− and β=+∞, μQer(u)=1 for u≥q+ (el is for extreme left and er for extreme right). Furthermore, transforming an irregular crisp partition into
a fuzzy partition may involve linguistic labels with meaningless values
(incompatibility problem). In this case, the slope of the increasing or decreasing part of these
fuzzy sets needs to be reasonably modified. Table 3 shows numerical results of
the different transformations based on data of Tables 1 and 2. The
transformation concerning the parameter consequence is illustrated by Figures
6(a), 6(b), 6(c), 6(d). The fuzzy partitions of risk parameters and SIL, which are
derived from the fuzzy intervals Q=[q−,[s−,s+],q+],
are given by Figures 7(a), 7(b),
7(c), 7(d) and 8. A more detailed description of these partitions is presented in the following:Table 3
Transformation of crisp intervals into Fuzzy intervals.
Transformation indicesLower mean valueUpper mean valueGeometric mean of[E*,E*]Lower boundary
of the coreC(Q)Upper boundary
of the coreC(Q)Left spread ofQRight spread ofQLower boundary
of the supportS(Q)Modified value
ofS−Upper boundary
of the supportS(Q)Modified value
ofS+SymbolsE*E*mq−q+αβS−S−*S+S+*ConsequenceMinor1.0E-091.0E-071.0E-083.162E-093.162E-084.325E-091.368E-07−1.162E-091.0E-091.684E-07—Moderate0.010.13.162E-021.778E-025.623E-021.557E-028.753E-022.217E-03—1.438E-01—Critical0.113.162E-011.778E-015.623E-011.557E-018.753E-012.217E-02—1.438E+00—Catastrophic1103.162E+001.778E+005.623E+001.557E+008.753E+002.217E-01—1.438E+0110ExposureRare0105.0E+002.50E+007.50E+005.0E+005.0E+00−2.50E+0001.250E+01—Frequent101005.50E+013.250E+017.750E+014.50E+014.50E+01−1.250E+017.50E+001.225E+02100AvoidanceNot likely0904.50E+012.250E+016.750E+014.50E+014.50E+01−2.250E+0101.125E+029.250E+01Possible901009.50E+019.250E+019.750E+015.0E+005.0E+008.750E+01—1.025E+02100Demand rateVery low1.0E-020.035.477E-047.401E-054.054E-031.280E-045.189E-02−5.401E-051.0E-055.595E-02—Low0.030.39.487E-025.335E-021.687E-014.670E-022.626E-016.652E-03—4.313E-01—Relatively high0.315.477E-014.054E-017.401E-012.107E-015.198E-011.946E-01—1.260E+001SIL (RRF = 1/ PFD)NSSR (a)1103.162E+001.778E+005.623E+001.557E+008.753E+002.217E-0111.438E+01—SIL1101003.162E+011.778E+015.623E+011.557E+018.753E+012.217E+00—1.438E+02—SIL21.0E+021.0E+033.162E+021.778E+025.623E+021.557E+028.753E+022.217E+01—1.438E+03—SIL31.0E+031.0E+043.162E+031.778E+035.623E+031.557E+038.753E+032.217E+02—1.438E+04—SIL41.0E+041.0E+053.162E+041.778E+045.623E+041.557E+048.753E+042.217E+03—1.438E+05—NR1.0E+051.0E+063.162E+051.778E+055.623E+051.557E+058.753E+052.217E+04—1.438E+061.0E+06Transformation of crisp intervals into fuzzy ones:
case of the parameter consequence:
(a) minor, (b) moderate, (c) critical, and (d) catastrophic.
(a)(b)(c)(d)Membership functions generated for risk parameters
(a) consequence, (b) exposure, (c) avoidance, (d) demand rate.Figure 8
Membership functions generated for SIL.(i)
consequence: four fuzzy
sets, namely, minor, moderate, critical, and catastrophic,
were defined on the input space of this variable (Figure 7(a)). The values
varying from 10−9 to 10 are represented on a logarithmic scale. To
the linguistic value minor defined in risk graph as no deaths is
assigned the crisp interval [10−9, 10−7] which suitably
represents an unlikely event. This interval is transformed into a fuzzy one
with the omission of the negative part. The interval [1,10] is selected to be the mean value of the fuzzy
set catastrophic with the possibility to change its upper bound
according to the hazardous situation. The increasing part of catastrophic is adjusted by taking the upper bound of the core of the fuzzy set critical as its beginning point.  This adjustment has double purpose. First, it removes
the negative part of the fuzzy interval associated with the term catastrophic,
which is meaningless from a point of view of number of fatalities.
Second, it avoids the overlapping between more than two fuzzy sets, which
involves many meaningless values for the class catastrophic. For
instance, the degree of membership of the zero value in the nonadjusted fuzzy
interval is 0.27.(ii)
Frequency and
exposure time: two fuzzy
sets, namely, rare and frequent, were defined on a linear scale
ranging from 0% to 100% (Figure 7(b)). The boundaries of their cores are
derived from arithmetic means of crisp interval subdivisions. As in the
previous risk parameter, the negative part of the first set rare is
removed, and the upper bound of its core has served as a lower bound of the
support of the second set frequent. The membership function of the
latter is obviously right open.(iii)
Possibility of avoiding hazard: as in the previous input
parameter, two fuzzy sets named, not likely and possible, respectively,
were defined on the universe [0,100] (Figure 7(c)). For the first set not likely, the negative part is removed
and the upper bound of its support takes the lower bound value of the core of
the set possible. The values of
the latter are limited to 100 with a right open membership function.(iv)
Probability of the unwanted occurrence: three fuzzy sets,
namely, very low, low, and relatively high, were defined
on a probability space ranging from 10−5 pa to 1 pa (Figure 7(d)). As for the first risk parameter, the
probability values are represented on a logarithmic scale. The choice of 10−5 pa (or 1.14 × 10−9 ph) as a lower bound of the interval [10−5, 0.03] refers to an
unlikely event. Only the first and the last fuzzy sets were adjusted by removing the negative part
and the values greater then one, respectively. The intermediate fuzzy set low is remaining unchanged.(v)
Safety integrity level (SIL): the SIL as a unique output
variable is defined on a RRF scale. The universe of discourse of the latter
consists of the interval [1, 106] with a regular crisp partition, that
is, there is a factor of ten between two successive subintervals. Seven fuzzy
sets were defined on the output space (Figure 8): four sets are associated with
the four SIL's, with the same labels as levels themselves, namely, SIL1, SIL2, SIL3, and SIL4, and the two sets named NSSR and  NR refer to the cases no special safety requirements and single SRS not
recommended, respectively. Except the delimitation of the set NR, no
adjustment is made for all these labels.


### 5.2.1. Derivation of the Fuzzy Rules

A number of fuzzy IF-THEN rules are extracted following the risk graph
logic and using the linguistic descriptors associated with risk parameters and
SIL. In this case, the rule base can be understood as a translation of the risk
graph which is mainly based on the knowledge and experience of analysts
regarding the process nature and required risk reduction. Both the number of
rules and input variables involved in premise parts depend on the risk graph
implementation, that is, the decomposition level of risk graph. In the premise
and conclusion parts of rules, the linguistic value meaning of input and output
variables are described by the fuzzy sets defined in step 2. The general form
of the derived fuzzy rules is(13)Ri:IFCisAiCandFisAiFandPisAiPandWisAiWTHENSILisBi where the risk
parameters C, F, P, and W stand for input variables; AiC,AiF,AiP, and AiW are their linguistic values, respectively. The SIL is an output variable with Bi as its linguistic value. The fuzzy vector (AiC,AiF,AiP,AiW) and the fuzzy set Bi are elements of the universes URP=UC×UF×UP×UW (RP for risk parameters) and USIL,
respectively. According to the risk graph reduction, the premise part of the
above rule may be reduced to two or three input variables. Referring to the
calibrated risk graph of Figure 2, two examples of fuzzy rules are the
following:(14)IFCisMarginalandFisFrequentandPisPossibleandWisLowTHENSILisSIL2,IFCisCriticalandFisRareandWisLowTHENSILisSIL3


### 5.2.2. Fuzzy Rule Base Application

As explained in Section4, fuzzy inference system methodology, when the
fuzzy inference system is to be applied to a set of input parameter values, the
information flows through the fuzzification-inference-defuzzification process
in order to generate the output value. Given any combination of input values
which cover the specific context of risk parameters, the fuzzy rule-based risk
graph will compute the RRF value that the SIF must achieve within the specific
context. The fuzzifier maps crisp input vector uRP0=(uC0,uF0,uP0,uW0) in URP to fuzzy sets in URP,
and the defuzzifier maps fuzzy sets in USIL.
If one or more risk parameters are not considered for a given rule, they will not
have any effect on the matching degree αi.


## 5.2.1. Derivation of the Fuzzy Rules

A number of fuzzy IF-THEN rules are extracted following the risk graph
logic and using the linguistic descriptors associated with risk parameters and
SIL. In this case, the rule base can be understood as a translation of the risk
graph which is mainly based on the knowledge and experience of analysts
regarding the process nature and required risk reduction. Both the number of
rules and input variables involved in premise parts depend on the risk graph
implementation, that is, the decomposition level of risk graph. In the premise
and conclusion parts of rules, the linguistic value meaning of input and output
variables are described by the fuzzy sets defined in step 2. The general form
of the derived fuzzy rules is(13)Ri:IFCisAiCandFisAiFandPisAiPandWisAiWTHENSILisBi where the risk
parameters C, F, P, and W stand for input variables; AiC,AiF,AiP, and AiW are their linguistic values, respectively. The SIL is an output variable with Bi as its linguistic value. The fuzzy vector (AiC,AiF,AiP,AiW) and the fuzzy set Bi are elements of the universes URP=UC×UF×UP×UW (RP for risk parameters) and USIL,
respectively. According to the risk graph reduction, the premise part of the
above rule may be reduced to two or three input variables. Referring to the
calibrated risk graph of Figure 2, two examples of fuzzy rules are the
following:(14)IFCisMarginalandFisFrequentandPisPossibleandWisLowTHENSILisSIL2,IFCisCriticalandFisRareandWisLowTHENSILisSIL3


## 5.2.2. Fuzzy Rule Base Application

As explained in Section4, fuzzy inference system methodology, when the
fuzzy inference system is to be applied to a set of input parameter values, the
information flows through the fuzzification-inference-defuzzification process
in order to generate the output value. Given any combination of input values
which cover the specific context of risk parameters, the fuzzy rule-based risk
graph will compute the RRF value that the SIF must achieve within the specific
context. The fuzzifier maps crisp input vector uRP0=(uC0,uF0,uP0,uW0) in URP to fuzzy sets in URP,
and the defuzzifier maps fuzzy sets in USIL.
If one or more risk parameters are not considered for a given rule, they will not
have any effect on the matching degree αi.


## 6. Conclusion

Although conventional risk graphs are relatively simple to be
implemented, they can lead to inconsistent results and possibly conservatism
that may result in SIL overestimation. Indeed, the use of qualitative
definitions for risk parameters is highly subjective and their meaning can be
misunderstood. On the other hand, numerical interpretation of risk parameters
and SIL's by means of crisp intervals violates gradual transition between
intervals which is more realistic.The proposed fuzzy risk graph model is a fuzzy rule based-risk graph. Its
main advantages may include the following.(i)
It preserves the four parameters
used in the standard risk graph and can be adapted easily to improved risk
graphs.(ii)
Fuzzy scales with fuzzy linguistic
values are used to assess risk parameters, and calibration of the model may be
made by varying risk parameters values.(iii)
The outcomes of the model which are numerical values of RRF
(1/PFD) can be compared directly with those given by more refined methods like FTA,
QRA, and LOPA.



---

*Source: 263895-2008-04-14.xml*