ACHIEVING ALARP WITH SAFETY INSTRUMENTED SYSTEMS

Transcription

1 ACHIEVING ALARP WITH SAFETY INSTRUMENTED SYSTEMS C.R. Timms, MIEE, United Kingdom, Tel: + 44 (0) , Emil: c.timms@ifb.co.uk Keywords: ALARP, hzrds, risk, sfety, SIS. Abstrct This pper sets out methodology for setting tolerble risk levels, for vrious methods of Sfety Integrity Level (SIL) determintion, to meet the principles s low s resonbly prcticble (ALARP). It mkes proposls on how to del with the tolerble risk concept for sfety instrumented systems (SIS) protecting ginst single hzrds. Introduction Sfety Instrumented Systems (SIS) re one of the most commonly used methods of reducing the risks ssocited with mjor ccident hzrds in the process nd other sectors. They cn be found in vrious systems such s emergency shut down, fire nd gs nd mchinery protection. A single SIS normlly provides protection ginst single hzrd, nd this poses dilemm for designers when they re trying to fulfil the overll requirements for reducing risk to s low s resonbly prcticble (ALARP) (see Figure ), since the concepts of ALARP re concerned with the totl risk from ll likely hzrds to workers or the public. However, SIL determintions for sfety instrumented systems re processed on hzrd by hzrd bsis. Thus these SIL risk ssessments re ll bsed on protective functionlity for single hzrds nd not the totl risk posed by ll likely hzrds corresponding to ALARP. Obviously the residul risk for ny single hzrd must still be tolerble but dditionl llownces must be mde to ensure tht the combined risk from ll likely hzrds will meet the ALARP concept. This pper mkes proposls for clibrting nd using vrious risk ssessment methods to chieve levels of tolerble risk, ssocited with ny single hzrd, to try nd meet the principles of ALARP. The pper discusses the determintion of sfety integrity levels for sfety functions where filure results in injury/ftlity of workers nd lso the societl risk spects when members of the public could be injured due to filure of the sfety function. It develops further some of the topics nd issues rised in Determintion of Sfety Integrity Levels Tking into Account ALARP-Cost Benefit Anlysis, 006 [] presented t the Hzrds XIX conference erlier in the yer. The following methods will be included in the context of setting tolerble risk levels: Fult Tree Anlysis Risk Grphs Risk Mtrices Lyers of Protection Anlysis (LOPA) Regultion complince In the Europen Community the Europen Seveso II directive, 996 [] requires ll hzrds to be identified nd risks to be reduced in line with the ALARP principles, s does the BS IEC 65, 00 stndrd []. The UK HSE offers guidnce in their publiction Reducing Risks Protecting People (RP), 00 [4] for the purposes of the Sttutory Instrument Control of Mjor Accident Hzrds Regultions 999 (COMAH) [5] which is the UK implementtion of the Europen Seveso II Directive. However, in ll the guidnce, the concept of ALARP is concerned with the totl risk from ll likely hzrds to workers or society. In Figure, the thresholds between the intolerble nd tolerble region, nd the tolerble to brodly cceptble regions, re indictors for the totl risk to the most exposed employee or society t lrge. Risk Intolerble region The ALARP or tolerbility region ( Reduce risk until cost of further risk reduction is grossly disproportionte ) Brodly cceptble region (No need for detiled working to demonstrte ALARP) UK HSE RP guidnce: x 0 - Employees X 0-4 Society Tolerble risk Set sfety trget Cost benefit nlysis to demonstrte ALARP x 0-6 All in 0 million per person/yr Negligible risk Figure ALARP Principles The primry objectives re to ensure tht the correct sfety functions hve been identified from the risk ssessment, nd tht the functionlity of these sfety functions is specified nd implemented correctly to reduce the residul risk posed by ny hzrd to tolerble level. The difficulty is determining wht the tolerble risk level should be for ny single hzrd.

2 In ddition, tolerble is not the sme s cceptble, it is level t which there is willingness to live with the risk in order to obtin the benefits. Risk Assessment Methods The risk ssessment method my be either qulittive or quntittive nd it does not hve to be quntified if it cn demonstrte tht the residul risk is better thn, or close to, the brodly cceptble region. However quntified or semi quntified methods re usully used when the levels of risk re quite high nd include: Fult Tree Anlysis Semi quntified Risk Grphs Semi quntified Risk Mtrices Lyers of Protection Anlysis (LOPA) Experience shows tht semi quntified pproch such s risk grph or risk mtrix is most pproprite to undertke the initil risk ssessment for lrge instlltions. They re simple to interpret, reltively fst to use nd they lso produce conservtive results. This is due to their rigid frmework, s this limits the number of prmeters for which risk reduction credit cn be climed. A more detiled nlysis of the higher SIL results cn then be undertken by methods such s Fult Tree Anlysis or LOPA. Fully quntified methods such Fult Tree Anlysis tend to be time consuming nd when whole process plnt is to be nlysed then it become n imprcticble exercise. Whether quntified or semi quntified methods re used, they require numericl vlue for the trget or objective residul risk. This then llows the nlysis to determine if sufficient risk reduction is chieved. This tolerble risk objective will be referred to s the Sfety Trget. 4 Setting Sfety Trgets Although most mjor orgnistions will probbly hve estblished corporte vlues for tolerble risk, this is often new experience for the mjority of end users of Sfety Instrumented Systems (SIS), nd n re which cuses considerble problems. None of the UK regultions offer typicl vlue for tolerble risk nd this is understndble since it will be dependnt on the disproportionl cost of further risk reduction, nd this will never hve ny typicl vlue. The HSE document Reducing Risks, Protecting People, 00 (RP) (prgrph 8) indictes the upper limit boundry between Tolerble nd Uncceptble risk, for workers, would be in,000 (.0E-0) per nnum, s shown in Figure. In (Prgrph 0) of RP the boundry between Tolerble nd Brodly Acceptble risk, for risks entertining ftlities, for both workers nd public is indicted s in,000,000 (.0E-06) per nnum s this corresponds to very low level of risk, s shown in Figure. These boundries re bsed on totl risk to the most exposed individul nd the dilemm fced by engineers involved in SIS is to understnd nd/or clculte where the tolerble risk, or sfety trget, should sit within the upper nd lower boundries for single hzrd. Where mjor ccident hzrd could impct on both workers nd the public then it is necessry to estblish tolerble risk levels for both. It is generlly expected tht the tolerble risk for the public, often referred to s societl risk, will be t lest ten times less, i.e. more restrictive thn for workers. Risk ssessment by SIL determintion only mkes n ssessment of the risk ssocited with single hzrd whilst ALARP is concerned with the most exposed person to ALL risks per nnum. It is prcticlly impossible for the SIS designer to estimte how mny simultneous risks n individul might be exposed to when considering design to protect ginst specific hzrd in prticulr re, s ll risks embrce wide spectrum of hzrds including slips, trips nd flls. It is simply not prcticble to try nd resolve such complex problem for ll workers nd society for every individul sfety instrumented function (SIF). Thus some rtionle needs to be estblished to mke llownces for the fct tht only single hzrds re nlysed during SIL determintion. It my be possible to try nd estimte ll the hzrds tht might be encountered by the most exposed individul, under norml routines nd occupncy, nd then tke n verge for the Sfety Trget. Another option is to use judgement to set the single hzrd Sfety Trget fctor more sensitive thn corporte ll risks per nnum tolerble risk trget. This would mke llownces for these uncertin multiple risk conditions; e.g. if corporte ll risks per nnum ws set t of in 000 (.0E-0), for the most exposed individul, then if fctor of ten ws used the single hzrd tolerble risk would be reduced to in 0,000 (.0E-04). The HSE do not currently provide guidnce on the scle of this fctor, nd opinion rnges between 0 nd 00, but there is generl greement in the industry tht fctor of t lest 0 is sufficient. Where the consequences of hzrdous event impct upon the public then Societl Risk ssessment is required. Ech operting orgnistion must set their societl risk criteri nd this is quite commonly set to be fctor of ten times lower thn for on site workers; e.g. If the tolerble risk for workers ws set t.0e-04 then the tolerble societl risk could be.0e-05. Thus the suggested fctor of ten risk reduction for single hzrds cn be pplied to both the tolerble risk for workers nd society. If risk is being ssessed for multiple proximity plnt site, then the trget for society/public needs to be proportionlly further reduced, i.e. if there re ten plnts in close proximity

3 then the public risk trget needs to be fctor of nother ten times lower. This would not be the cse for workers s they usully work on one plnt with exposure limited to hzrds from tht plnt. However, considertion needs to be given too ny potentil for domino escltion between sites. 4. Sfety Trgets nd Risk Reduction Risk nlysis determines if existing risk reduction mesures re sufficient. Risk reduction is generlly mde up of number of different lyers nd some typicl exmples re shown in Figure. Mitigting Lyers: e.g. Deluge nd Emergency Response Procedures Other Protective Lyers: e.g. Pressure Relief Sfety Instrumented Systems Alrm Lyer Process Control Lyer Process design Figure Risk Reduction Lyers Totl risk reduction is product of the individul risk reduction mesures. Thus ech risk reduction lyer normlly hs quntified vlue ttributble to it. Hving estblished Sfety Trget or tolerble risk for ny single hzrd, the objective of the risk ssessment is to estimte the risk reduction chieved by existing mesures, in numericl terms, nd to compre this with the Sfety Trget such tht: Sfety Trget Product of Existing Risk Reduction Mesures 5 Setting Sfety Trgets This section will discuss wys in which Sfety trgets cn be set for different methods of risk ssessment. 5. Risk Grphs Risk grphs re fr more useful nd consistent when ll the prmeters re semi quntified. The generl rrngement of the BS IEC 6508 risk grph used for Personnel Sfety is shown in Figure. Strting point for risk reduction ssessment C A C B C C C D F A F B F A F B F A F B P A P B P A P B P A P B P A P B W W W 4 b Figure Risk Grph Generl Arrngement The grph uses the following prmeters for mking the risk ssessment: C = Consequence severity Where C = Number of people x Vulnerbility Fctor F = Occupncy of the hzrdous re being considered P = Alterntives to void the hzrd W = Frequency of demnd on the SIS or likelihood,,,4 = Sfety integrity level (SIL) The ctul Sfety Trget delivered by this kind of grph is best demonstrted by n exmple shown in Tble This will indicte if dditionl risk reduction mesures re needed nd the vlue of required risk reduction required. The reltionship between the required risk reduction nd the probbility of filure on demnd (PFD) used in SIS design is: An exmple risk Prmeter Low Vlue High / Risk Reduction = PFD The Reltionship between SIL, risk reduction nd PFD is provided in BS IEC 65 nd is shown in Tble. SIL Risk Reduction PFD E-.0E E-.0E E-.0E E-4.0E-5 Tble SIL, Risk Reduction nd PFD The PFD rnge of vlues, for specific SIL, is often referred to s the SIL Bnd. grph hs been Vlue ssigned W 0..0 prmeters with W the vlues W opposite: CA CB 0.0 A typicl SIL CC.0 determintion hs CD >.0 resulted in risk FA pth with the FB.0 highlighted PA prmeters. PB.0.0 Ech prmeter hs SIL 0.0 rnge vlue with SIL high nd low end SIL vlues SIL Tble Exmple Risk Grph Clibrtion

4 The clibrtion ssigned to ech prmeter hs rnge of vlues with high nd low end vlue. An exmple SIL determintion is highlighted on the risk grph in Figure nd in the prmeters of Tble. These result in specific clibrtion for the risk grph. The high end nd low end vlues of ny prmeter impct on the overll risk ssessment e.g. From the exmple in Tble, the frequency of demnd prmeter of W rnges from 0.0 yers to 0. yers. Obviously the risk is less if the demnd is 0.0/yer thn if it ws 0./yer. If ll the prmeters were t their low end of rnge this would result in the highest level of chievble risk reduction of.0e-08, or best cse s shown in Cse A: is required to meet the Tolerble Risk for single hzrd i.e. the Sfety Trget. 5. Risk Mtrix Risk mtrices fford fr more limited risk ssessment thn risk grphs, but they cn still be semi quntified to help with ssessment consistency. Figure 4 shows bsic 5 x 4 mtrix. Consequence CA CB None 0.0- W.0-0. Likelihood (Demnds Per Yer) W W W0 <0.00 (Low CC) * (Low FA) * (PB) * (Low W) * (Low SIL ) Thus: Cse A = () * (0.0) * (.0) * (0.0) * (0.00) Cse A =.0E-08 CC CD CE >0 4 If ll the prmeters were t their high end of rnge this would result in the lowest level of chievble risk reduction of.0e-04, or worst cse s shown in Cse B: (High CC) * (High FA) * (PB) * (High W) * (High SIL ) Thus: Cse B = (.0) * () * (.0) * (0.) * (0.0) Cse B =.0E-04 Tking the two extreme cses the verge risk reduction cn be clculted s follows: The risk reduction fforded by the best cse: Cse A =.0E-08 nd The risk reduction fforded by the worst cse: Cse B =.0E-04 Since the exmple risk grph is bsed on logrithmic scling the verge risk figure is the logrithmic verge of the best nd worst risk vlues: Ln(Averge risk) = (Ln A +Ln B)/ Ln(Averge risk) = ((Ln(.0E-08) +Ln(.0E-04))/ Averge risk for this exmple =.0E-06 for ny single hzrd nd represents the Sfety Trget chieved by this risk grph exmple. Similr risk grphs with specific tolerble risk trgets for societl consequences, sset loss nd environmentl consequences usully form complete risk ssessment. The Sfety Integrity Level (SIL) which is delivered by this type of risk grph represents the dditionl risk reduction tht Figure 4 Exmple Risk Mtrix There re now only three prmeters to be considered: W = Likelihood C = Consequence severity Where C = Number of people x Vulnerbility Fctor,,,4 = Sfety Integrity Level (SIL) As with the risk grph exmple, ech prmeter hs rnge of vlues. To understnd how the clibrtion works it is best demonstrted by n exmple s shown in Figure 4, where SIL ssessment hs resulted in W, CC nd SIL. Then if ll the prmeters were t their low end of rnge this would result in the highest level of chievble risk reduction of.0e-05, or the best cse s shown in Cse A: Cse A = (Low CC) * (Low W) * (Low SIL ) Thus: Cse A = () * (0.0) * (0.0) Cse A =.0E-05 If ll the prmeters were t their high end this would result in the lowest level of chievble risk reduction of.0e-0, or the worst cse s shown in Cse B: Cse B = (High CC)* (High W) * (High SIL ) Thus: Cse B = (.0) * (0.) * () Cse B =.0E-0 Since the risk exmple mtrix is bsed on logrithmic scling the verge risk figure is the logrithmic verge of the best nd worst cse risk vlues: Ln(Averge risk) = (Ln A +Ln B)/ Ln(Averge risk) = ((Ln(.0E-05) +Ln(.0E-0))/

5 Averge risk for this exmple = 9.0E-04 for ny single hzrd nd represents the Sfety Trget chieved by this risk mtrix exmple. 5. Fult Tree Anlysis Fult Tree Anlysis is probbly the most strightforwrd of ll risk ssessment methods for determining the difference between ny existing risk reduction nd Sfety Trget. Freq/ yr.0 PFD Event Pressure surge occurs Pressure control fils High pressure lrm fils Opertor fils to respond SIF fils Relief Vlve fils Impct Event Overpressure nd loss of continment from First Stge Seprtor Surge Control /yr 0./yr Alrm Opertor 0.0/yr SIF 0.00/yr Figure 5 Exmple Fult Tree Anlysis Totl Mitigted Event Frequency 7.5E-04 RV x0-4 /yr Loss of Continment Tking very simple exmple s shown in Figure 5 the likelihood of n undesirble loss of continment event is clculted t.0e-04/yer. This cn be compred with the required tolerble risk, nd djustments cn then be mde to the SIF PFD, or other mesures tken s required. 5.4 Lyers of Protection Anlysis (LOPA) LOPA is rpidly becoming populr method for risk ssessment nd SIL determintion nd guidnce on ppliction cn be founding the Americn Institute of Chemicl Engineers Centre for Chemicl Process Sfety document - Lyer of Protection Anlysis Simplified Process Assessment, 00[6]. A simple exmple of sfety bsed LOPA worksheet is shown in Figure 6. Protection & Mitigtion Lyers Event Frequency Process design Relief vlve Process Control Occupncy Independent lrm Intermedite Event Frequency Tolerble Event Frequency Required SIS risk reduction Inititing Cuse Blocked Outlet /yer E-04.0E-05 Inititing Cuse Process Control 0./yer E-04.0E-05/7.5E-04 =.E-0 (SIL ) Figure 6 Exmple Lyers of Protection Anlysis As with risk grphs LOPA must be quntified to provide meningful nd consistent results. A tolerble risk or Sfety - Trget must lso be set. The consequence severity nd likelihood of hzrdous event re quntified for every cuse/consequence pir, in the bsence of ny protection or mitigtion mesures. Credit is tken for risk reduction fforded by independent protection lyers nd lso fctors which re considered to mke contribution towrds mitigting the consequences. Ech lyer, for which risk reducing credit is tken, is ssigned n pproprite quntified risk reduction fctor. Conditionl modifiers re lso used to credit further risk reduction which might only be specific to workers, society, the sset or the environment; e.g. bund round tnk or closed drins will reduce the environmentl impct of spillge but hve no effect on the sset loss. Some typicl risk reduction lyers re shown in Figure nd might include: Inherent process design fctors; Process control systems; Alrm systems if independent from the process control; Existing sfety instrumented functionlity; Personnel occupncy of the re; Mechnicl protection such pressure relief; Mitigting mesures such s fire nd gs systems; Sfety procedures; Emergency response procedures. The totl mitigted event frequency is compred with the tolerble risk frequency trget tht hs been set for workers, society, the sset nd environment nd the difference equtes to ny dditionl risk reduction fctor to be contributed by the SIS. 6.0 Use of Cost Benefit Anlysis (CBA) When sfety trget is set for ny risk ssessment method then, by chieving the determined SIL for the SIS, the sfety trget will be met. However, there still remins the question bout whether sufficient risk reduction hs been mde for stisfying the s low s resonbly prcticble requirement i.e. should dditionl risk reduction mesures be pplied? 6. CBA Bckground The UK guidnce, on the reltionship between s low s resonbly prcticble (ALARP) nd the use of cost benefit nlysis (CBA), cn be found in the HSE RP document. The CBA is bsed on n estimte of the costs of risk reduction mesures nd the number of csulties sved by implementtion. Thus the cost of preventing ftlity (CPF) tkes the form: CPF = Totl cost of the risk reduction mesures () Totl ftlities prevented

6 Then by compring this with the vlue of preventing ftlity (VPF) n estimte cn be mde of the proportion fctor: Proportion Fctor = CPF / VPF () When the Proportion Fctor is or less (or even or less) then RP dvises tht dditionl mesures should be implemented. * RP Appendix Pr grph : VPF is often misunderstood to men tht vlue is being plced on life. This is not the cse. It is simply nother wy of sying wht people re prepred to py to secure n verge risk reduction. A VPF of,000,000 corresponds to risk reduction of in 00,000 being worth 0 to n verge individul. VPF is therefore not to be confused with wht society, or the courts, might put on the life of rel person or the compenstion pproprite to its loss. VPF will vry depending on the prticulr hzrdous sitution. This is fine for ssessing the benefit where no risk reduction hs been previously specified. The CBA is little more complex when n opertor lredy hs specified certin risk reduction mesures, but needs to demonstrte whether further risk reduction would be cost effective. This is often the sitution when designing SIS. In mny cses the cost of existing mesures is not known, prticulrly on legcy or brown field instlltions. 6. Developing CBA for n Existing Sfety Trget The difference between the current risk reduction mesures nd the dditionl risk reduction, chieved by implementtion of further mesures, hs to be nlysed. This involves the dditionl costs of implementtion, the difference in risk reduction chieved nd the vlue for ll ftlities prevented over the predicted life time opertion of the fcility. In this cse from (): Proportion Fctor = CPF/VPF Or: P f = CPF/VPF Then: CPF = P f * VPF () And since () CPF = Totl cost of the risk reduction mesures Totl ftlities prevented Then : Substituting () in (4) for CPF: (Pf * VPF) * Totl ftlities prevented = Totl cost of risk reduction mesures (5) And since the totl ftlities prevented is represented by product of the frequency of demnd (F) on the SIS, the probbility of filure on demnd (PFD), the operting life of the plnt (PL) nd the number of ftlities (N) resulting from the hzrdous event: Totl ftlities prevented = F x PFD x PL x N (6) Then substituting for (6) in (5): (Pf * VPF) * (F * PFD * PL * N) = Totl cost of risk reduction mesures (7) Where: Pf = Proportion fctor VPF = Vlue of preventing ftlity F = Frequency of demnd on the SIF (for rnge use high frequency vlue) PFD = Probbility of filure of the SIF PL = Plnt operting life N = Number of ftlities per hzrdous event Where n existing risk reduction proposl hs been mde through risk ssessment (such s by use of risk grph or LOPA), then the dditionl ftlities prevented will be proportionl to the difference between the PFD of the existing solution nd the PFD with further risk reduction mesures. If pfd = PFD of existing proposl from risk ssessment pfd = PFD with dditionl risk reduction mesures Totl ADDITIONAL ftlities prevented = F * (pfd - pfd ) * PL * N (8) Then by tking eqution (5): P f * VPF * Totl ftlities prevented = Totl cost of risk reduction mesures Substituting (8) for totl dditionl ftlities prevented : Totl justified cost of FURTHER risk reduction mesures = P f * VPF * (F * (pfd - pfd ) * PL * N) (9) But t wht vlue should the objective pfd be set? This pper suggests tht the ALARP threshold of brodly cceptble is the ultimte objective i.e..0e-06 for both workers nd public for ll risks. CPF* Totl ftlities prevented = Totl cost of risk reduction mesures (4)

7 Thus using the fctor of ten times more sensitive for ny single hzrd this would be pfd of.0e-07. Note. RP indictes the Proportion Fctor P f should be: 0 when working close to tolerble/uncceptble boundry; - when working close to the brodly cceptble boundry. A vlue of will be used for P f s pdf is t the brodly cceptble level of risk. 6. Exmple of CBA for given Sfety Trget The justifible dditionl cost for chieving the principle of ALARP is best demonstrted by wy of n exmple: Where: The tolerble risk will be bsed on the exmple risk grph clibrtion described in Section 5. i.e..0e-06; Vlue of preventing ftlity (VPF) =,000,000 for voluntry (workers); The boundry between Tolerble nd Brodly Acceptble = in,000,000 for both workers nd public HSE RP. The number of onsite ftlities estimted due to mjor toxic relese (N) = 0. The frequency of demnd (F) = ( in ten yers). The opertionl plnt life expectncy (PL) = 0 yers. The PFD of current proposl (pfd ) =.0E-06 (Tolerble risk clibrtion of the risk grph). The PFD with dditionl mesures (pfd ) =.0E-07 (The brodly cceptble vlue of.0e-06 for public nd workers incresed by fctor of ten for the single hzrd nlysis). Then by using eqution (9): Totl cost of risk reduction mesures (C t ) = P f * VPF * (F * (pfd - pfd ) * PL * N) 7.0 Finding the Optiml Sfety Trget The SIS engineer relly needs to know where the optiml Sfety Trget is before setting out on the risk ssessment process. If this could be determined then clibrting the chosen risk ssessment method to the optiml Sfety Trget vlue, nd designing the SIS to chieve the trget, would ensure complince with the ALARP principles. This cnnot be done by simply mking stb in the drk but mking multiple itertions for the CBA clcultions could be prohibitively time consuming. The optiml Sfety trget cn be found by using eqution (9) to plot rnge of initil PFD options (i.e. pfd ) to brodly cceptble PFD vlue (i.e. pfd ). The VPF cn be set to the compny vlue nd the number of ftlities per hzrdous event cn be ssessed by the norml risk ssessment methods. This is gin best demonstrted by n exmple: VPF =,000,000 N = 0 PL = 0 yers F = /yer If rnge of pfd vlues is plotted for 0 ftlities ginst brodly cceptble risk for pdf of.0e-07 (for single hzrd) then Figure 7 indictes tht further risk reduction mesures of mny millions of pounds would be justified if the current risk reduction mesures chieved less thn.0e-. It lso indictes tht there is distinct flttening of the curve t round.0e-04 indicting the region of the optiml Sfety Trget nd chieving greter risk reduction thn this vlue is likely to stisfy ALARP principles. Justified Cost of Further Mesures 5,999,000 4,999,000,999,000 Acceptble Risk =.0E-7 Workers (VPF =.0 Million), 0 ftlities, 0 yer plnt life, demnd = /yr C t =.0 *,000,000 * ( * (.0E-6.0E-7) * 0 * 0),999,000 Series C t = 74,999,000 Thus the totl discounted cost of further risk reduction mesures would need to be below 74. Therefore, in this exmple, dditionl mesures would be implemented if the totl cumultive discounted cost over the plnt/project life of 0 yers ws below 74. This lso demonstrtes tht the clibrtion of the sfety trget, for the risk grph used in this exmple, is very close to ALARP. 999,000 -,000.E-.E-.E-.E-.E-.E-.E-.E Current Risk Reduction Figure 7 Justified Cost of Further Mesures / Current Risk Reduction If the curve is plotted for single ftlity over the sme rnge s in Figure 7b the scle of the justified cost of further risk reduction mesures decreses, s would be expected, but the knee of the curve is identicl.

8 Justified Cost of Further Mesures 599, ,000 Acceptble Risk =.0E-7 Workers (VPF =.0 Million), ftlity, 0 yer plnt life, demnd = /yr However, the pproches nd methodology tht hve been described re only one prctitioner s perspective. The purpose of this pper is to stimulte discussion nd promote the need for further guidnce on ALARP from Sfety Instrumented Systems perspective. 99,000 99,000 99,000 99,000 -,000.E- 0 0.E- 0 0.E E E Current Risk Reduction.E E E- 08 Series References [6] Americn Institute of Chemicl Engineers Centre for Chemicl Process Sfety, Lyer of Protection Anlysis Simplified Process Assessment, 00. [] BS IEC 65-: Functionl sfety - Sfety Instrumented Systems for the process industry sector Prt : Guidnce for the determintion of the required sfety integrity levels. (00). Figure 7b Justified Cost of Further Mesures / Current Risk Reduction It would pper to mke gret del of sense to plot curve like Figures 7 nd 7b, in preprtion for risk ssessment exercise. It then only requires simple cross check to determine the justifible cost of further risk reduction mesures to comply with the ALARP principles. Idelly, the Sfety Trget would be set to vlue low down in the knee of the curve so tht the outcome of the risk ssessment would then deliver SIL requirements meeting ALARP principles. Similr curves cn be plotted to tke ccount of the pproprite level of VPF for hzrds tht put the public t risk. [] Europen Seveso Directive, 98 (Council Directive 8/50/EEC) reviewed 996 nd dopted s Seveso II Directive. [5] HMSO Sttutory Instruments 999 No. 74. The Control of Mjor Accident Hzrds Regultions 999 (COMAH) - ISBN [4] HSE document: Reducing Risks, Protecting People (RP). (00) - ISBN: [] C Timms Determintion of Sfety Integrity Levels Tking into Account ALARP- Cost Benefit Anlysis presented t the Hzrds XIX conference Mrch Discussion There is considerble gp between the current guidnce on ALARP, which is concerned with totl nnul risk from ll hzrds, nd the sitution fcing designers of functions within sfety instrumented systems protecting ginst single hzrds. Designers re currently forced to develop their own rtionle for implementing SIS to meet the ALARP principles for protection ginst single hzrds. This pper hs mde suggestions for setting tolerble risk trgets, or Sfety Trgets, for single hzrds, nd it hs lso indicted how these cn then be developed to demonstrte ALARP through cost benefit nlysis. Methodology hs been proposed for ssessing the difference between the proposed, or current, risk reduction mesures, nd wht would the justifible cost of dditionl risk reduction mesures, in ALARP terms. It hs lso been demonstrted tht there is no need for extensive cost benefit nlysis providing the risk ssessment, nd subsequent design is undertken to suitbly set tolerble risk levels.