Using LOPA for Other Applications

10 Using LOPA for Other Applications 10.1. Purpose LOPA is a tool used to perform risk assessments. Previous chapters described its use in assessing the risk level of process hazards scenarios and in evaluating whether adequate layers of protection exist. The objective of this chapter is to identify and discuss other specific uses of LOPA. This chapter will describe how LOPA is used in: capital improvement planning management of change mechanical integrity programs or risk-based inspection/risk-based maintenance risk-based operator training emergency response planning determining a credible design basis for overpressure protection evaluating facility siting risks evaluating the need for emergency isolation valves evaluating the removal of a safety system from service incident investigations determining SIL for SIF. 163

164 10. Using LOPA for Other Applications 10.2. Using LOPA in Capital Improvement Planning Costs are associated with risk mitigation measures. There are also benefits derived from risk mitigation actions. Some companies are using cost benefit analyses to evaluate the relative merits of alternative risk-reducing cost expenditures. These results are used to prioritize projects. At the completion of a LOPA, a risk level is determined and safeguards to reduce the risk are identified. These safeguards can reduce risk by lowering the frequency of occurrence of a scenario (or, in some cases, by reducing the severity of the consequence). A capital expenditure is usually required to obtain the desired risk reduction. A decision must be made on which safeguard or set of safeguards to select. The LOPA method can be integrated with a cost benefit method to assist with this decision. Integrating LOPA with a cost benefit analysis is a tool that Captures the economic benefit from reducing risk. Enables decision makers to allocate resources to provide the greatest benefit. This also helps the organization decide on which of several options to pursue to achieve an acceptable risk level for a given project. Compares the economic attractiveness of different projects. This also helps the organization decide when to further reduce the risk level for several projects which are marginally acceptable versus tolerable risk criteria. The parameters and procedures of this cost benefit analysis are organization dependent, but the general principle is the same in all cases. Organizations must assign a dollar value to both the unmitigated scenario and mitigated scenario and to the risk reduction effort. Most use a net present value calculation where the time value of money is accounted for as a function of time and interest rate. Tax consequences and inflation can be incorporated into the models, or the models can be kept simple. All of the scenarios evaluated with this procedure are equated to a financial impact, which is defined in terms of what is important to the organization. Financial impact can be identified in many ways. Some of the categories used by companies are the cost of minor/major injuries/fatalities to employees, minor/major injuries/fatalities to the off-site population, equipment loss/replacement, business loss due to production down time, business loss due to undesirable publicity, productivity loss due to employee morale, legal action, environmental cleanup, regulatory agency fines.

10.3. Using LOPA in Management of Change 165 The benefit of the risk reduction is defined as the difference between the financial impact at the high-risk condition and the financial impact at the lowrisk condition. This difference is divided by the cost of the risk reduction effort and the result is called the benefit to cost ratio. Most companies compare the alternatives on a relative basis rather than expecting the analysis to yield absolute cost savings. The method can be used to compare competing or alternate projects which will reduce the same risk scenario, or can be used to help decide which projects to undertake among all risk reduction projects. The important point is the establishment of the link with the LOPA technique and the use of the LOPA evaluation findings in the cost benefit analysis. 10.3. Using LOPA in Management of Change LOPA is well suited for use in the management of change (MOC) process to identify the safety issues involved in the modification of a process, procedures, equipment, instrumentation, etc., and whether the modification will meet corporate risk tolerance criteria. The LOPA summary sheet (see Appendices A and C) provides a concise means of documenting the results of the analysis and can be included with the other MOC documentation. A suitably qualified analyst must either perform the LOPA studies or review the results. All referenced documentation must be available to the analyst. A typical procedure for using LOPA in the MOC process, if no previous LOPA analysis has been performed on the system, involves the following steps: 1. Specify the process, procedure, equipment, instrumentation, etc., involved in the change. 2. Develop scenarios for the unmodified process, procedure, equipment, instrumentation, etc., to assess the current risk level using LOPA, and document the results. Effects that may propagate into other parts of the process must also be included in the analysis. 3. Repeat the LOPA analysis using the proposed modification(s) to assess the risk, and document the results. 4. Summarize the findings of the LOPA study and, if appropriate, document that the proposed change meets the corporate risk tolerance criteria. Attach this documentation with the complete MOC documentation. If a LOPA analysis has already been completed, then only steps 3 and 4 must be performed. LOPA studies can help an organization focus on the important issues involved in making a change. LOPA studies are self-documenting, and the MOC documentation should refer to the LOPA documentation.

166 10. Using LOPA for Other Applications 10.4. Using LOPA in Mechanical Integrity Programs or Risk- Based Inspection/Risk-Based Maintenance Programs Safety critical equipment (SCE) are engineering controls that provide independent layers of protection to lower the risk category of a specific scenario or scenarios from unacceptable to acceptable as defined by the organizational risk tolerance criteria. Chapter 6 contains several rules for determining if an engineering control is an IPL. In particular, the engineering control must be independent of other engineering controls, must be specifically designed to prevent or mitigate the consequence of a potentially hazardous event, and must be auditable. It is important to note that some IPLs may not be safety critical equipment because they may simply lower the risk from acceptable to even more acceptable. LOPA is an excellent way to identify safety critical equipment. Scenario 2a in Section 6.7 identified the dike for the existing hexane storage tank, the tank s existing BPCS LIC, and the proposed SIF as IPLs whose probabilities of failure on demand were 1 10 2, 1 10 1, and 1 10 2, respectively. If the approach presented in this section is applied, these IPLs would be considered SCEs. After claiming these PFDs, these SCEs must be maintained to insure their effectiveness. For example, they could be placed on a safety critical equipment list to insure that they are inspected, tested, and maintained. Many companies use risk-based decision-making tools like LOPA to identify SCEs and to drive risk-based inspection and maintenance programs. For example, one company uses a frequency/consequence tool that is very similar to LOPA to prioritize its inspection and maintenance activities. This company recently reported the following benefits associated with their program (Leonard and Lodal, 1998): Significant opportunities for improving mechanical integrity of critical safety equipment. Major improvements in their overall process safety programs. Improved business results due to higher utilization of existing equipment, fewer unplanned shutdowns due to unexpected failures, and targeting of scarce resources to the most risk-critical processes. Decreased production costs without adverse affects on the environment, safety, or health. 10.5. Using LOPA in Risk-Based Operator Training LOPA is an excellent tool to identify safety critical actions, such as administrative or human actions that provide independent layers of protection to lower the risk category from unacceptable to acceptable. An example of a safety critical action is an operator response (e.g, closing a valve) to an alarm.

10.7. Using LOPA for Overpressure Protection 167 A second example is a procedure that ensures that blinds and caps on openended valves or connections are kept in place to prevent release of material if the valve is inadvertently opened. A third example is the wiring of the ears on quick-disconnect hose connection fittings to prevent the hose from disconnecting during loading or unloading operations. The safety critical actions identified can be placed on a safety critical action list to insure that the operators receive more frequent and focused training to insure operator knowledge and performance. The amount of training should be commensurate with the assumed PFD. This means that a company can realize significant savings by targeting training resources to the most critical operations. LOPA can also be used to improve operating procedures by highlighting critical operations and consequences of exceeding established operating limits. 10.6. Using LOPA in Emergency Response Planning As discussed in Chapter 4, two important inputs to the LOPA program for a potential accident scenario are the mitigated as is consequence and the mitigated as is frequency of occurrence. A company using LOPA would be able to document a substantial number of estimated mitigated as is offsite consequences. The following benefits would then be realized when this documentation is shared with local emergency planners: Planners would better understand the community risk. Local emergency response planning would improve because planners will be able to combine the more likely and significant accidental release information with other local planning. Coordination would increase between emergency response planners and facility personnel. Public confidence and acceptance of the emergency response planning process would increase. Emergency response planners would be able to conduct more effective table top and evacuation drills and develop more effective gas detection monitoring systems to protect human health and the environment. The chemical industry s involvement in community response planning would be expanded. 10.7. Using LOPA to Determine a Credible Design Basis for Overpressure Protection In1995/1996, ASME approved Code Case 2211 (ASME, 1995). This allows pressure vessels to be protected by system design in lieu of mechanical relief devices subject to the following conditions (Windhorst, 1998):

168 10. Using LOPA for Other Applications 1. The vessel is not exclusively in air, water or steam service. 2. The decision to provide a vessel with overpressure protection by system design is the responsibility of the user. The manufacturer is only responsible for verifying that the user has specified overpressure protection by system design, and for listing this Code Case on the data report. 3. The user shall ensure that the MAWP (maximum allowable working pressure) of the vessel is greater than or equal to the highest pressure that can reasonably be expected to be achieved by the system. The user shall conduct a detailed analysis, which examines all credible scenarios that can result in an overpressure condition. CAUTION This is a short summary of the results of ASME CODE CASE 2211. The reader is advised to study the code in detail before proceeding with this practice. IPLs used to reduce the frequency of a scenario to the extent that a mechanical relief device is not required must be inspected, maintained, and tested to ensure that the necessary PFDs are achieved. Some companies apply ASME Code Case 2211 to evaluate critically scenarios that are considered in determining the worst credible relief system design basis. In such evaluations LOPA can be used to determine the existing IPLs and their failure probabilities, and to help define the worst credible event design basis for sizing pressure relief devices. A credible event has been defined in Guidelines for Pressure Relief and Effluent Handling Systems (CCPS, 1998b) as a scenario or event that has reasonable and sufficient likelihood of occurrence that it should be considered in selecting the design basis for an emergency relief system. This should be based on a risk analysis that includes a careful and thorough review of process characteristics, experience with similar systems, the hazardous nature of the materials handled, and the consequences of an incident. LOPA provides an organization with a risk assessment tool to help ensure that credible scenarios are determined in a uniform, consistent manner throughout the corporation (see Chapter 4). An important aspect in the selection of the design basis for relief systems is the ability to identify the non-credible scenarios and to document why they were not selected as the design basis. The definition of a non-credible scenario is based on the company s risk tolerance criteria. LOPA is an effective tool in this type of screening. There are normally many scenarios resulting in overpressure that are considered during the design of emergency relief systems. These scenarios

10.7. Using LOPA for Overpressure Protection 169 include, but are not limited to, runaway reactions, fire exposure, a blocked outlet pipe, utility failures and operational and equipment failures. The relief devices are sized to handle the most severe credible design case. For many exothermic batch reaction systems, the runaway reaction scenario is often the worst case design basis. In many instances the relief device size required to safely handle these exothermic runaway reactions would be so large that it would be impractical/uneconomical to proceed with the required design. LOPA can be used as a screening tool to evaluate if additional layers of protection could be added to reduce the likelihood of the runaway reaction-initiating event to a sufficiently low level so that it would not be considered a credible design basis scenario. In this example, if the likelihood of a runaway reaction is reduced to a noncredible level, then the fire exposure case or other credible scenario would become the design basis. When LOPA screening indicates a sufficiently low scenario frequency, a quantitative risk analysis should be performed to confirm the low occurrence frequency of the undesired scenario. Typical factors that companies use to decide whether a full FTA (fault tree analysis) is required are the conservatism in the scenario development, and the magnitude of the difference between the projected mitigated risk level and the maximum tolerable risk level. Under no circumstances should LOPA by itself be used to eliminate relief devices for a specific system. CAUTION When the results of a LOPA screening suggest a sufficiently low frequency of a specific scenario, it is strongly recommended that this be verified by a CPQRA study before removing the scenario from the basis for relief device sizing. 10.8. Using LOPA in Evaluating Facility Siting Risks LOPA is also a useful tool for evaluating facility siting risks within the company s fence line. This procedure is as follows: 1. Identify and develop credible fire, explosion, and/or toxicity scenarios which could impact occupants in buildings or affect buildings where people congregate or must go for emergency equipment. 2. Use LOPA to estimate the frequency of occurrence, consequence category, and the existing risk level within the existing layers of protection.

170 10. Using LOPA for Other Applications 3. If the existing risk level is deemed unacceptable per the organization s facility siting risk tolerance criteria, LOPA can be used to identify opportunities to reduce these risks and screen out certain scenarios from facility siting consequence analysis by identifying appropriate and additional IPLs. Some companies have obtained significant dollar savings by applying LOPA by avoiding the relocation of occupied buildings, installation of new blast walls, or implementation of other measures. CCPS has issued a detailed eight-step procedure for identifying and reducing facility siting risks. Several application examples are shown in Guidelines for Evaluating Process Plant Buildings for External Explosions and Fires (CCPS, 1996a). All of the CCPS examples use quantitative risk decision-making tools. LOPA can be used as a screening tool within the eight-step protocol. 10.9. Using LOPA to Evaluate the Need for Emergency Isolation Valves Isolation valves are used to isolate a process unit if a leak occurs in a piping system or if a fire threatens to cause such a leak. These valves are usually located in a piping system so that, when closed, they prevent the sustained release of a large volume of flammable, toxic, or environmentally detrimental material. Such a release could result in a large widespread fire or the generation of a vapor cloud explosion. Examples include ethylene and propylene pipelines, propylene or LNG storage spheres and large liquid phase reactor systems. Such valves are often designed to be fire-safe and can be actuated from the control room or from local panels in the field. They may also have a dedicated air cylinder to provide back-up to the plant air system. These systems are expensive and are normally installed only in selected locations. Another use of LOPA is for evaluating the need/justification for these isolation systems. Once a company has decided which type of consequence analysis to use (see Chapter 3) and how to set its risk acceptance criteria (see Chapters 7 and 8) the method would involve, for each candidate system: 1. Determining the release size that could, as a minimum, produce the consequence(s) of interest. This might be in terms of a given mass of material, a fatality, a certain estimated capital damage, lost production, etc. (see Chapter 3). 2. Creating scenarios that would result in the release of large quantities of toxic or flammable materials assuming no isolation valve is in place. These could include: An external fire that could cause another release by damaging piping, pumps, instrument lines, etc. Piping or flange leaks

10.10. Using LOPA to Evaluate Taking a Safety System Out of Service 171 Pump seal failures Third party intervention 3. Calculating the frequency of these initiating events (see Chapter 5). For example, for piping leaks the calculation is done by multiplying the total length of pipe by the expected frequency (per unit length) of the type of leak that leads to the consequence of interest. 4. Determining the risk associated with the system without an isolation valve in place. This could involve using a consequence/frequency matrix, or fatality frequency, or some other method to judge whether the risk associated with the system without isolation valves is acceptable given the particular risk tolerance criteria used. Depending upon the method employed, the frequency associated with each scenario can be examined individually, or the total frequency for all scenarios associated with the system can be calculated. If the risk is acceptable then the installation of an isolation valve is not necessary (see Chapters 6, 7 and 8). 5. Determining viable options if the risk is unacceptable (see Chapter 8): Installing isolation valves Examining the mechanical design of the system to make it less susceptible to failures. This might include using welded piping, using a different pipe size, changing the pump seal designs, etc. Examining the process design of the system to determine if the amount of material released could be reduced. This could involve changing the pipe size, operating conditions, or materials. This is not normally a viable option, especially for existing facilities. CAUTION The design and installation of isolation valve systems is complex and must be considered carefully. If such a system is used to reduce risk it must meet the requirements for an IPL and the appropriate PFD must be applied to assure that the level of risk reduction gained by installing such a system is sufficient. In addition, unless the isolation valves are activated immediately after the leak occurs, they may not prevent a significant vapor cloud formation or a significant toxic release. Therefore, a quick, reliable detection and actuation system is essential. 10.10. Using LOPA to Evaluate Taking a Safety System Out of Service LOPA can be used to determine whether a critical IPL safety system can be bypassed or taken out of service for a short, known time duration and to

172 10. Using LOPA for Other Applications determine what additional layers of protection would be required in the interim. The procedure for doing this is as follows: 1. Identifying the accident scenarios where the IPL is critical. 2. Identifying alternative safeguards that can take the place of the bypassed IPL to maintain the same risk level. (There may be some cases where an option of increasing the risk level for a short time duration is possible, as long as this new risk level is tolerable by the company s risk criteria standards.) One example of this type of action is a simple temperature control system that is part of a basic process control system. If high temperature is detected in a reactor system, an automatic control valve in the emergency cooling water line is opened and the emergency cooling water is used to bring the temperature back to the desired level. If this system must be taken off-line for service, it may be acceptable to use an operator to monitor the temperature of the reactor if the temperature begins to rise, the operator opens a manual valve to allow emergency cooling water flow to the reactor. LOPA performed on this scenario would indicate whether this is acceptable for a given company or whether additional layers of protection are required. There are many other cases where LOPA can be used to evaluate the safeguards utilized by a company when a primary safety system is bypassed. 10.11. Using LOPA during Incident Investigations Several companies have found LOPA to be a useful analysis and communication tool during incident investigations. For example, one company used LOPA to show how additional IPLs could have prevented a recent gas fired spray dryer explosion incident at its chemical plant. LOPA has been used to identify scenarios with a common IPL that was compromised in an incident and to show how to add additional IPLs to reduce the frequency of occurrence. 10.12. Using LOPA in the Determination of SIL for SIF LOPA can be used to determine the required SIL (safety integrity level) for SIFs (safety instrumented functions). See the continuing example in Chapter 8 for more details. In LOPA, the necessary PFD of a SIF is specified to meet the risk tolerance criteria. One form of LOPA for this purpose is referenced in IEC 61511, Part 3 (IEC, 2001). Click here to go to Chapter 11