11

Identification and Screening Identification and Screening of Scenarios for LOPAof Scenarios for LOPA

Ken FirstKen FirstDow Chemical CompanyDow Chemical Company

Midland, MIMidland, MI

22

Layers of Protection Analysis (LOPA)

“LOPA is a semi-quantitative tool for analyzing and assessing risk. The primary purpose is to determine if there are sufficient layers of protection against an accident scenario (can the risk be tolerated?).”

Layers of Protection Analysis, Center for Chemical Process Safety, American Institute

of Chemical Engineers, New York (2001)

33

Key Concerns with Key Concerns with Implementation of LOPAImplementation of LOPA

Variability in identification of credible scenarios to enter into LOPA.

Consistent evaluation of scenario consequences in “understandable” terms of damage severity or human harm.

Overall effort for implementation and re-validation of LOPA.

44

Work Process Steps for Simplified Risk Analysis

Select equipment items to include in hazard evaluation

Compile chemical, process and plant information needed

Identify event sequences that could lead to an incident

Estimate the release quantity, rate and hazard distance

Quantify the Consequence in terms of potential damage or injury

Estimate the frequency or likelihood of event sequence

Estimate risk from consequence and frequency

Identify and Assess Independent Protective Layers

Is Risk Tolerable?

Yes

NoCan Risk be Reduced?

Manage Residual Risk

Full Risk Assessment

and/or Discontinue

ActivitySelect potential incident outcome

cases for review

55

Select an Equipment Item to Include in Hazard Evaluation

Most chemical process facilities utilize the same basic process equipment – vessels, pumps, heat exchangers, columns, etc.

Select an equipment item based on the potential for a chemical process hazard similar to selection of a HAZOP “node” to begin the process.

66

Types of Chemical Process Hazards

Process Risk typically addresses acute hazards including:

Flammability

Toxicity (Inhalation)

Reactivity (Chemical Energy)

Pressure-Volume Energy

77

The potential to harm people, damage property or the environment depends upon: Chemical Properties (flash point, etc.)

Process Conditions (operating temp., etc.)

Equipment Parameters (volume, etc.)

Site and Plant Layout (distance to public, etc.)

Recognition of Chemical Process Hazards

88

Relationship between Chemical Properties and

Process ConditionsChem. PropertyChem. Property

Flash PointFlash Point

LFLLFL

MIEMIE

ERPG ERPG ConcentrationsConcentrations

Heat of ReactionHeat of Reaction

Gas GenerationGas Generation

Detected Onset Detected Onset TemperatureTemperature

Process ConditionProcess Condition

Temperature > FPTemperature > FP

Concentration > LFLConcentration > LFL

Ignition Source > MIEIgnition Source > MIE

Vapor Concentration > Vapor Concentration > ERPGERPG

Maximum Reaction Maximum Reaction Temp. and PressureTemp. and Pressure

Temperature > TTemperature > TNRNR

Pressure > Design Pressure > Design PressurePressure

Hazard

Flammability

Toxicity

Reactivity

P-V Energy

99

Pump Deadhead (Blocked in while running)

Blocked in with Thermal Expansion

Overfill

Excessive Heat Input

Uncontrolled Reaction

Physical Damage

Etc.

Through operational experience, incident and hazard evaluation history; common process upsets may be categorized and related to specific types of equipment.

Common Categories of Process Upsets

1010

A Scenario Case represents an unplanned sequence of events leading to an incident

with undesired consequence.

Initiating Event

+ Enabling Conditions

Inci

dent Outcome with

Undesired Consequence

Failure of Independent

Protective Layers

Scenario IdentificationScenario Case

1111

Initiating Event starts an event sequence and is typically categorized as:

Control system failure

Human error

Mechanical failure

Incident is an unintended release of hazardous material or energy.

Consequence is a measure of the potential Outcome in terms of injury, damage, or economic loss.

Scenario IdentificationSequence of Events

1212

Categories of Chemical Process Incidents

Hole Size release rate.Standardized hole sizes simplify the screening analysis, for

example:- 5 to 10 mm to represent gasket failure.- 100 mm to full bore diameter to represent pipe or equipment

nozzle failure.

Overflow rate estimated from feed or fill rate. Excessive Heat vapor release rate estimated

from rate of heat input divided by heat of vaporization.

Catastrophic Failure or Rupture as a sudden release of entire equipment contents and reaction or pressure-volume energy.

1313

A Scenario Case also represents a relationship between Process Upset,

Initiating Event, Incident Category, and Outcome for a specific Equipment Type.

Scenario IdentificationScenario Case

These relationships may be used to pre-develop a list of scenario

cases to consider.

1414

Scenario IdentificationCommon Relationships

Scenario TypeScenario Type Parameter/ Parameter/ DeviationDeviation

Equipment Equipment TypesTypes

Initiating Initiating EventsEvents IncidentsIncidents ConditionsConditions

DeadheadDeadhead FlowFlow--NoneNone TempTemp--HighHigh

PumpPump CompressorCompressor

Control FailureControl Failure Human ErrorHuman Error RuptureRupture Max. Pressure > Burst PressureMax. Pressure > Burst Pressure

Overflow, Overfill, Overflow, Overfill, or Backflowor Backflow

LevelLevel--HighHighFlowFlow--BackflowBackflow

VesselVessel ColumnColumn

Control FailureControl Failure Human ErrorHuman Error

OverflowOverflow(thru Vent)(thru Vent)

Inventory > Equip Volume Inventory > Equip Volume andandFeed Pressure > Op PressureFeed Pressure > Op Pressure

Overflow Overflow (thru Relief)(thru Relief)

Inventory > Equip Volume Inventory > Equip Volume andand Max Pressure > Relief PressureMax Pressure > Relief Pressure

Excessive Excessive PressurePressure PressurePressure--HighHigh VesselVessel

ColumnColumnControl FailureControl Failure Human ErrorHuman Error

OverflowOverflow(thru Relief)(thru Relief)

Max Pressure > Relief Set Max Pressure > Relief Set PressurePressure

RuptureRupture Max Pressure > Burst PressureMax Pressure > Burst Pressure

Excessive HeatingExcessive Heating TempTemp--HighHigh Heat InputHeat Input--HighHigh

VesselVessel ColumnColumnExchangerExchanger

Control FailureControl Failure Human ErrorHuman Error

Vapor ReleaseVapor Release (Relief)(Relief)

Max Pressure > ReliefMax Pressure > ReliefSet PressureSet Pressure

RuptureRupture Max Pressure > Burst PressureMax Pressure > Burst Pressure

Loss of Loss of ContainmentContainment

FlowFlow--Loss ofLoss ofContainmentContainment AllAll MechanicalMechanical

IntegrityIntegritySmall HoleSmall HoleMedium HoleMedium Hole Large HoleLarge Hole

Frequency depends upon internal or Frequency depends upon internal or external corrosion, screwed versus external corrosion, screwed versus welded construction, etc.welded construction, etc.

Uncontrolled Uncontrolled ReactionReaction

TempTemp--HighHigh CompositionComposition-- WrongWrongFlowFlow--BackflowBackflow

VesselVessel ExchangerExchanger PumpPump

Control FailureControl Failure Human ErrorHuman Error Utility FailureUtility Failure

Vapor ReleaseVapor Release (Relief)(Relief) Max Pressure > Relief PressureMax Pressure > Relief Pressure

RuptureRupture Max Pressure > Burst PressureMax Pressure > Burst Pressure

Example Predetermined Scenario List

1515

Scenario IdentificationAnalysis Team

Use of a predetermined list of feasible scenarios may help the Analysis Team to quickly identify other cases to consider.

The Team may find additional relationships between scenario type, initiating event, incident category, and outcome to extend the predetermined list.

Elucidation of the initiating event (“How could this happen in my plant?”) may also help the Team identify scenario cases to consider.

1616

Overfill of T-127 acrylonitrile storage tank leading to a release at a rate equal to the fill rate caused by process control failure

resulting in . . .

Scenario IdentificationScenario Description

Process Upset Equipment Type

Incident Category Initiating Event

Chemical Involved

An Outcome must be selected based on the chemical process hazard and potential Consequence

to complete the Scenario Description.

1717

Simplified Analysis for Selection of Incident Outcome

Simplified source models are used to estimate release rates, airborne quantities, and hazard distances as part of determining feasible incident Outcomes.

For simplicity, selection of a single wind speed, stability, and surface roughness may

be appropriate for LOPA analysis.x

y

z

H

(x,0,0)

(x,-y,0)

(x,-y, z)

1818

Example Outcome Selection Criteria

Flash (or Jet) FirePersonnel exposure to 0.1 to 0.5 times LFL

Vapor Cloud Explosion1000 Kg flammable release (100 Kg for high flame speed)

Building ExplosionIndoor concentration exceeds LFL

Physical Explosion (and BLEVE)Exposure to 1 psi overpressure (0.3 psi for fragmentation)

Toxic Vapor Release (Indoor, Outdoor)Off-site exposure to > ERPG-2 concentration (60 min)On-site exposure to > ERPG-3 concentration

A single incident may have several potential outcomes.

1919

Simple Analysis of Outcome Consequence

A simple Consequence Analysis may be based on Hazards originating from a point source such that the effect zone is estimated in

terms of radial distance from the source.

Personnel within the effect zone are assumed severely impacted while

those outside of this area are assumed not affected.

Wind

Cloud Plume

Release Point

Effect Zone (Probability of

Severe Impact = 1)

Probability of Severe Impact = 0

2020

Quantification of Consequence Severity

The number of personnel severely impacted may be estimated as impact area times population density.On-site population density should account for

maintenance and other personnel in the process area and “worst case” wind direction.

For scenario cases where personnel are anticipated to be in close proximity to the release point, the number of personnel at risk assumed as the number in attendance.

2121

Quantification of Consequence Severity

In some cases, the number of personnel severely impacted is significantly less than one.May indicate a relatively low probability of

serious injury of fatality.May indicate that a minor injury is a more

likely consequence than a serious injury or fatality.

2222

Example Consequence Severity Categories

The estimated number of people impacted is not

precise such that a consequence

category representing an

“order of magnitude”

range may be more

appropriate.

Low Minor on-site injury, no lost timeMinor (non-reportable) environmental eventMinimal equipment damage or production loss

MediumPublic annoyance (odor, alert, etc.)Recordable on-site injury, not severeOffsite environmental impact or permit violationEquipment damage with some lost production

HighOne or more injuries to the publicOne or more severe on-site injuries or fatalitySignificant release/severe environmental impactMajor damage to process equipment (>$1 MM)

Very HighOne or more serious injuries or fatality to the publicMultiple severe on-site injuries or fatalitiesLong-term contamination and/or large kill of wildlifeMajor destruction and business loss (>$10 MM)

Catastrophic Significant off-site disruption with multiple injuries/fatalities resulting in public enquiry and prosecutions

Consequence Severity Description

No impact on the public

2323

Likelihood EvaluationProbability and Frequency

Estimates of frequency and probability are inherent in risk analysis as many scenario cases represent rare, but catastrophic, event sequences.

Initiating Events are represented as frequency (events per year).

Enabling Events or Conditions are represented by probability (between zero and one).

2424

Likelihood EvaluationEnabling Events

Enabling Events must generally be present or met for the event sequence to proceed from initiating event to incident outcome.

Probability of Ignition

Fraction of Time at Risk based on mode of operation (start-up, specific operational step or procedure, etc.)

Probability of Successful Evasive Action

Others

2525

Risk EstimationConsequence and Frequency

Initiating Event Frequency

XEnabling Condition

Probability

IPL Probability of

Failure on Demand

Tolerable Consequence Frequency to

Meet Risk Target

X <

Initiating Event

+ Enabling Conditions

Inci

dent Outcome with

Undesired Consequence

Failure of Independent

Protective Layers

2626

Risk EstimationExample Risk Matrix

10-2 / Year

10-3 / Year

10-4 / Year

10-5 / Year

10-6 to 10-8 / Year

FrequencyConsequence Severity

Low HighMedium CatastrophicVery High

The target frequency for a scenario case should be set conservatively compared with corporate

or regulatory risk criteria

* “As low as reasonably practicable” may apply.

Tolerable

Tolerable

Tolerable

Tolerable

Tolerable

TolerableTolerable

Tolerable

Tolerable

Tolerable

IntolerableTolerable

Tolerable*

Tolerable

Tolerable*

Tolerable*

Intolerable

Intolerable Intolerable

Intolerable

Intolerable

Intolerable

Intolerable

Intolerable

Intolerable

2727

A simple semi-quantitative risk analysis involving process upset (scenario type), incident category, and outcome is a promising means to identify and evaluate hazard scenario cases for LOPA.

Estimates of release rate, hazard distance, and people impacted provide a means for reducing variability in quantifying consequence and setting target frequencies.

Results may be validated against conventional quantitative risk analysis techniques and periodically updated to ensure they are appropriately conservative in meeting corporate or regulatory guidance.

LOPA Scenario IdentificationSummary and Conclusions

2828

LOPA Scenario Identification Key References

Layers of Protection Analysis, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (2001).

Guidelines for Hazard Evaluation Procedures, 2nd Edition, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (1992)

Guidelines for Chemical Process Quantitative Risk Analysis, 2nd Edition, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (2000)

Guidance on “as low as reasonably practicable” (ALARP) decisions in control of major accident hazards (COMAH), Health and Safety Executive, UK (2002), available at: http://www.hse.gov.uk.

Risk Management Program Guidance for Offsite Consequence Analysis, United States Environmental Protection Agency, available at: http://www.epa.gov/ceppo.

Freeman, R., Using Layer of Protection Analysis to Define Safety Integrity Level Requirements, Process Safety Progress, 26 (2007)