Identification and Screening of Scenarios for LOPA Ken First Dow Chemical Company Midland, MI 1
Layers of Protection Analysis (LOPA) LOPA is a semi-quantitative tool for analyzing and assessing risk. The primary purpose is to determine if there are sufficient layers of protection against an accident scenario (can the risk be tolerated?). Layers of Protection Analysis, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (2001) 2
Key Concerns with Implementation of LOPA Variability in identification of credible scenarios to enter into LOPA. Consistent evaluation of scenario consequences in understandable terms of damage severity or human harm. Overall effort for implementation and re-validation of LOPA. 3
Work Process Steps for Simplified Risk Analysis Select equipment items to include in hazard evaluation Compile chemical, process and plant information needed Identify event sequences that could lead to an incident Estimate the release quantity, rate and hazard distance Select potential incident outcome cases for review Quantify the Consequence in terms of potential damage or injury Estimate the frequency or likelihood of event sequence Estimate risk from consequence and frequency Is Risk Tolerable? Can Risk be Reduced? Yes No Identify and Assess Independent Protective Layers Manage Residual Risk Full Risk Assessment and/or Discontinue Activity 4
Select an Equipment Item to Include in Hazard Evaluation Most chemical process facilities utilize the same basic process equipment vessels, pumps, heat exchangers, columns, etc. Select an equipment item based on the potential for a chemical process hazard similar to selection of a HAZOP node to begin the process. 5
Types of Chemical Process Hazards Process Risk typically addresses acute hazards including: Flammability Toxicity (Inhalation) Reactivity (Chemical Energy) Pressure-Volume Energy 6
Recognition of Chemical Process Hazards The potential to harm people, damage property or the environment depends upon: Chemical Properties (flash point, etc.) Process Conditions (operating temp., etc.) Equipment Parameters (volume, etc.) Site and Plant Layout (distance to public, etc.) 7
Hazard Flammability Relationship between Chemical Properties and Process Conditions Chem. Property Flash Point LFL MIE Process Condition Temperature > FP Concentration > LFL Ignition Source > MIE Toxicity ERPG Concentrations Vapor Concentration > ERPG Reactivity Heat of Reaction Gas Generation Detected Onset Temperature Maximum Reaction Temp. and Pressure Temperature > T NR P-V Energy Pressure > Design Pressure 8
Common Categories of Process Upsets Through operational experience, incident and hazard evaluation history; common process upsets may be categorized and related to specific types of equipment. Pump Deadhead (Blocked in while running) Blocked in with Thermal Expansion Overfill Excessive Heat Input Uncontrolled Reaction Physical Damage Etc. 9
Scenario Identification Scenario Case A Scenario Case represents an unplanned sequence of events leading to an incident with undesired consequence. Initiating Event + Enabling Conditions Failure of Independent Protective Layers Incident Outcome with Undesired Consequence 10
Scenario Identification Sequence of Events Initiating Event starts an event sequence and is typically categorized as: Control system failure Human error Mechanical failure Incident is an unintended release of hazardous material or energy. Consequence is a measure of the potential Outcome in terms of injury, damage, or economic loss. 11
Categories of Chemical Process Incidents Hole Size release rate. Standardized hole sizes simplify the screening analysis, for example: - 5 to 10 mm to represent gasket failure. - 100 mm to full bore diameter to represent pipe or equipment nozzle failure. Overflow rate estimated from feed or fill rate. Excessive Heat vapor release rate estimated from rate of heat input divided by heat of vaporization. Catastrophic Failure or Rupture as a sudden release of entire equipment contents and reaction or pressure-volume energy. 12
Scenario Identification Scenario Case A Scenario Case also represents a relationship between Process Upset, Initiating Event, Incident Category, and Outcome for a specific Equipment Type. These relationships may be used to pre-develop a list of scenario cases to consider. 13
Scenario Type Deadhead Overflow, Overfill, or Backflow Excessive Pressure Excessive Heating Loss of Containment Uncontrolled Reaction Scenario Identification Common Relationships Example Predetermined Scenario List Parameter/ Deviation Flow-None Temp-High Level-High Flow-Backflow Pressure-High Temp-High Heat Input-High Flow-Loss of Containment Temp-High Composition- Wrong Flow-Backflow Equipment Types Pump Compressor Vessel Column Vessel Column Vessel Column Exchanger All Vessel Exchanger Pump Initiating Events Control Failure Human Error Control Failure Human Error Control Failure Human Error Control Failure Human Error Mechanical Integrity Control Failure Human Error Utility Failure Incidents Rupture Overflow (thru Vent) Overflow (thru Relief) Overflow (thru Relief) Rupture Vapor Release (Relief) Rupture Small Hole Medium Hole Large Hole Vapor Release (Relief) Rupture Conditions Max. Pressure > Burst Pressure Inventory > Equip Volume and Feed Pressure > Op Pressure Inventory > Equip Volume and Max Pressure > Relief Pressure Max Pressure > Relief Set Pressure Max Pressure > Burst Pressure Max Pressure > Relief Set Pressure Max Pressure > Burst Pressure Frequency depends upon internal or external corrosion, screwed versus welded construction, etc. Max Pressure > Relief Pressure Max Pressure > Burst Pressure 14
Scenario Identification Analysis Team Use of a predetermined list of feasible scenarios may help the Analysis Team to quickly identify other cases to consider. The Team may find additional relationships between scenario type, initiating event, incident category, and outcome to extend the predetermined list. Elucidation of the initiating event ( How could this happen in my plant? ) may also help the Team identify scenario cases to consider. 15
Scenario Identification Scenario Description Process Upset Chemical Involved Equipment Type Overfill of T-127 acrylonitrile storage tank leading to a release at a rate equal to the fill rate caused by process control failure Incident Category resulting in... Initiating Event An Outcome must be selected based on the chemical process hazard and potential Consequence to complete the Scenario Description. 16
Simplified Analysis for Selection of Incident Outcome Simplified source models are used to estimate release rates, airborne quantities, and hazard distances as part of determining feasible incident Outcomes. z (x,0,0) x For simplicity, selection of a single wind speed, stability, and surface roughness may be appropriate for LOPA analysis. y H (x,-y, z) (x,-y,0) 17
Example Outcome Selection Criteria Flash (or Jet) Fire Personnel exposure to 0.1 to 0.5 times LFL Vapor Cloud Explosion 1000 Kg flammable release (100 Kg for high flame speed) Building Explosion Indoor concentration exceeds LFL Physical Explosion (and BLEVE) Exposure to 1 psi overpressure (0.3 psi for fragmentation) Toxic Vapor Release (Indoor, Outdoor) Off-site exposure to > ERPG-2 concentration (60 min) On-site exposure to > ERPG-3 concentration A single incident may have several potential outcomes. 18
Simple Analysis of Outcome Consequence A simple Consequence Analysis may be based on Hazards originating from a point source such that the effect zone is estimated in terms of radial distance from the source. Personnel within the effect zone are assumed severely impacted while those outside of this area are assumed not affected. Probability of Severe Impact = 0 Wind Release Point Effect Zone (Probability of Severe Impact = 1) Cloud Plume 19
Quantification of Consequence Severity The number of personnel severely impacted may be estimated as impact area times population density. On-site population density should account for maintenance and other personnel in the process area and worst case wind direction. For scenario cases where personnel are anticipated to be in close proximity to the release point, the number of personnel at risk assumed as the number in attendance. 20
Quantification of Consequence Severity In some cases, the number of personnel severely impacted is significantly less than one. May indicate a relatively low probability of serious injury of fatality. May indicate that a minor injury is a more likely consequence than a serious injury or fatality. 21
Example Consequence Severity Categories The estimated number of people impacted is not precise such that a consequence category representing an order of magnitude range may be more appropriate. Consequence Severity Low Medium High Very High Catastrophic Description No impact on the public Minor on-site injury, no lost time Minor (non-reportable) environmental event Minimal equipment damage or production loss Public annoyance (odor, alert, etc.) Recordable on-site injury, not severe Offsite environmental impact or permit violation Equipment damage with some lost production One or more injuries to the public One or more severe on-site injuries or fatality Significant release/severe environmental impact Major damage to process equipment (>$1 MM) One or more serious injuries or fatality to the public Multiple severe on-site injuries or fatalities Long-term contamination and/or large kill of wildlife Major destruction and business loss (>$10 MM) Significant off-site disruption with multiple injuries/ fatalities resulting in public enquiry and prosecutions 22
Likelihood Evaluation Probability and Frequency Estimates of frequency and probability are inherent in risk analysis as many scenario cases represent rare, but catastrophic, event sequences. Initiating Events are represented as frequency (events per year). Enabling Events or Conditions are represented by probability (between zero and one). 23
Likelihood Evaluation Enabling Events Enabling Events must generally be present or met for the event sequence to proceed from initiating event to incident outcome. Probability of Ignition Fraction of Time at Risk based on mode of operation (start-up, specific operational step or procedure, etc.) Probability of Successful Evasive Action Others 24
Risk Estimation Consequence and Frequency Initiating Event + Enabling Conditions Failure of Independent Protective Layers Incident Outcome with Undesired Consequence Initiating Event Frequency X Enabling Condition Probability IPL Probability of Failure on Demand X < Tolerable Consequence Frequency to Meet Risk Target 25
Frequency Risk Estimation Example Risk Matrix The target frequency for a scenario case should be set conservatively compared with corporate or regulatory risk criteria Low Medium Consequence Severity High Very High Catastrophic 10-2 / Year Tolerable Intolerable Intolerable Intolerable Intolerable 10-3 / Year Tolerable Tolerable Intolerable Intolerable Intolerable 10-4 / Year Tolerable Tolerable Tolerable* Intolerable Intolerable 10-5 / Year Tolerable Tolerable Tolerable Tolerable* Intolerable 10-6 to 10-8 / Year Tolerable Tolerable Tolerable Tolerable Tolerable* * As low as reasonably practicable may apply. 26
LOPA Scenario Identification Summary and Conclusions A simple semi-quantitative risk analysis involving process upset (scenario type), incident category, and outcome is a promising means to identify and evaluate hazard scenario cases for LOPA. Estimates of release rate, hazard distance, and people impacted provide a means for reducing variability in quantifying consequence and setting target frequencies. Results may be validated against conventional quantitative risk analysis techniques and periodically updated to ensure they are appropriately conservative in meeting corporate or regulatory guidance. 27
LOPA Scenario Identification Key References Layers of Protection Analysis, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (2001). Guidelines for Hazard Evaluation Procedures, 2nd Edition, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (1992) Guidelines for Chemical Process Quantitative Risk Analysis, 2nd Edition, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York (2000) Guidance on as low as reasonably practicable (ALARP) decisions in control of major accident hazards (COMAH), Health and Safety Executive, UK (2002), available at: http://www.hse.gov.uk. Risk Management Program Guidance for Offsite Consequence Analysis, United States Environmental Protection Agency, available at: http://www.epa.gov/ceppo. Freeman, R., Using Layer of Protection Analysis to Define Safety Integrity Level Requirements, Process Safety Progress, 26 (2007) 28