基于STAMP/STPA的LNG船对船过驳系统安全性分析

针对LNG船对船过驳作业具有高危险性和高复杂性的特点, 探究在作业过程中其复杂系统部件发生异常交互的安全性问题, 基于系统理论和控制理论构建LNG船对船过驳系统的STAMP控制关联模型, 将船对船过驳系统拆分为多个层次结构, 形成约束控制和反馈, 并采用系统理论过程分析STPA方法, 识别过驳作业中的系统级事故、系统级危险, 以及潜在的不安全控制行为, 构建考虑了人工控制器的过驳系统致因场景分析模型, 从系统控制缺陷、反馈缺陷和协调缺陷3个方面提出了系统中的22个致因因素。结果表明, LNG过驳系统中潜在致因因素众多, 传感器系统失效、控制阀失效和操作员人为因素等是引发多个系统级危险的重要原因, 并从致因因素出发提出安全控制措施。该方法应用于具有人、软件、设备等大量交互的船舶过驳动态作业中, 不仅克服了仅关注关键部件故障和不能包含系统动态行为的局限性, 同时还考虑到系统中未发生故障组件之间的不安全交互相关问题。 

A Safety Analysis of LNG Ship-to-ship Transfer System Based on a STAMP/STPA Model

Given the high risk and complexity of LNG ship-to-ship transfer operations, the safety problem of abnormal interaction of complex system components during operation is studied. A system-theoretic accident model and process(STAMP)control association model of the LNG ship-to-ship transfer system is constructed based on system theory and control theory splitting the ship-to-ship transfer system into multiple hierarchical structures to form constrained control and feedback. The system theoretic process analysis(STPA)method is adopted to identify system-level accidents, system-level hazards, and potential unsafe control behaviors in transfer operations. A causal scenario analysis model considering manual controllers is developed, and 22 causal factors in this system are proposed from system control defect, feedback defect, and coordination defect. The results show many potential causes in the LNG transfer system. Sensor system failure, control valve failure, and operator human factors are important causes of multiple system-level hazards, and safety control measures are proposed from the causal factors.This method is applied to the dynamic operation of ship transfer with a large number of interactions among people, software, and equipment, considering the non-faulty components in the system and overcoming the limitation of focusing on the failure of key components and excluding the dynamic behavior of the system.