The AB Company produces automotive fuel from biomass and is counting down to an initial public offering (IPO) of its stock in a year-and-a-half, where it will describe itself as an inherently safe and green company. The fuel it produces is a mixture of alcohols and hydrocarbons; it is actually both flammable and harmful to the environment.

The company has a control system for filling tank trucks from its product storage tank. A high-level interlock closes the outlet valve from the storage tank whenever the level in a tank truck is too high. The CEO of AB was shocked to learn recently that its state-of-the-art, automated interlock had a typical failure rate of 0.1 failures/year. The CEO wants the failure rate to be zero, especially before the IPO. He has suggested that they install a second, redundant, high level interlock that uses a separate level sensor to close an independent outlet valve, to guarantee that there cannot be a failure.

Over the next year-and-a-half, between now and the IPO, what would the probability of failure be for a single high-level interlock? What would the probability of failure be if a second high-level interlock were installed? A third? A fourth? A fifth? Does it ever get to zero?

Now, take into consideration that there are common cause failures for process interlocks, particularly the main process control module. When the main process control module fails, all of the interlocks tied into it will also fail. There is some uncertainty about what the beta for common cause failures is for such a system, with estimates ranging from as low as 0.1% to as much as 10%. What is the impact of a common cause failure with a beta of 5% on the probability of failure for one, two, three, four, or five separate high-level interlocks?

Based on your calculations, what would you recommend, and why?