APPENDIX A. Continuing Examples

Transcription

1 Layer of Protection Analysis: Simplified Process Risk Assessment by Center for Chemical Process Safety Copyright 2001 American Institute of Chemical Engineers APPENDIX A LOPA Summary Sheets for the Continuing Examples This appendix contains the completed LOPA sheets for the four continuing examples used in this book using the three decision-making methods discussed in Chapter 8 (risk matrix, fatality frequency, and required number of IPLs). In addition the results of the analysis using the method of a major chemical company are also shown. The solutions presented in this appendix are not necessarily consistent when one method is compared with another, as the methods differ in their assumptions. Other approaches using the LOPA concepts presented in this book or developed by a particular organization can also be used. However, they must be internally consistent and the risk tolerance criteria must be fully developed so that analysts and teams can determine whether the risk associated with a scenario is acceptable for an individual organization. These LOPA sheets contain all the information necessary for understanding the scenario (initiating event, enabling event/condition, consequence, existing IPLs and proposed IPLs to meet the defined risk criteria). The format of these sheets conforms to that discussed in Chapter 4 and in Appendix C (Documentation) for the three methods discussed in this book. The results of the fourth method are shown in the format used by the organization that developed it. Any format containing the required information is acceptable, but it must be adequately maintained and tracked. The solutions contained in these sheets are the result of discussion among individuals from several companies which use different methods. As such there have been some adjustments in the data used for the sake of consistency. Each company participating in the development of this book would not necessarily have reached the same conclusions as those shown in the 191

2 ~~~~ _ 192 Appendix A. LOPA Summary Sheets for the Continuing Examples accompanying sheets. Therefore, the examples contained in this appendix must not be considered definitive solutions to the problems discussed. They are, rather, illustrative of the concepts and approaches used. Each company must consider all of the factors that are required to implement LOPA and apply them consistently within their own organization. A comparison of the results of the analysis of these examples using the four methods is shown in Table A List of Summary Sheets for the Continuing Examples Continuing Consequence Categorization Risk Decision Table No. Example Method Making Method rable A.l la Risk Matrix (Method 1 of Chapter 3) Risk Matrix rable A.2 lb Risk Matrix (Method 1 of Chapter 3) Risk Matrix rable A.3 2a Risk Matrix (Method 1 of Chapter 3) Risk Matrix rable A.4 2b Risk Matrix (Method 1 of Chapter 3) Risk Matrix rable A.5 la Fatality Frequency (Method 3 of Chapter 3) Numerical Criteria rable A.6 lb Fatality Frequency (Method 3 of Chapter 3) Numerical Criteria rable A.7 2a Fatality Frequency (Method 3 of Chapter 3) Numerical Criteria Table A.8 2b Fatality Frequency (Method 3 of Chapter 3) Numerical Criteria rable A.9 la Fatality Frequency (Method 3 of Chapter 3) Required Number of lpls rable A.10 lb Fatality Frequency (Method 3 of Chapter 3) Required Number of lpls rable A.11 2a Fatality Frequency (Method 3 of Chapter 3) Required Number of lpls Table A.12 2b Fatality Frequency (Method 3 of Chapter 3) Required Number of IPLS Table A.13 Table A.14 Based on a Method from a Major Chemical Company (includes Continuing Example Scenarios la, lb, 2a, 2b) Comparison of Results - Required PFD for Added SIF

3 Appendix A. LOPA Summary Sheets for the Continuing Examples 193 TABLE A.l Summary Sheet for Continuing Example la: Risk Matrix Consequence Categorization Method (Method 1 of Chapter 3) Descriptian/Categmy 1 outs1 and failure of dike RiskToleaance Criteria 1 Action requrrd I I " (typiralty a frequency) Enabling Event or Cnnditinn fi.11 lurr is injttattng evc

4 194 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A.2 Summary Sheet for Continuing Example 1 b: Risk Matrix Consequence Categorization Method (Method 1 of Chapter 3) Consequence Descri ptianfcategury.l.l l".l."l" il.- Risk Tolerance Criteria (Category or Frequency) "l^l." l._"l "... l.l.l..." -... Initiating Event... (typically a frequeniy) 13nabIing thent or Condition Conditional hlodifivts (if applicable)

5 Appendix A. LOPA Summary Sheets for the Continuing Examples 195 TABLE A.3 Summary Sheet for Continuing Example 2a: Risk Matrix Consequence Categorization Method (Method 1 of Chapter 3) a Title: Hexnn~ Stnrage Tank Chwrfiow t contained by the dike "" "

6 196 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A.4 Summary Table for Continuing Example 2b: Risk Matrix Consequence Categorization Method (Method 1 of Chapter 3) Scenario Equipment h'umber Scenario Title: Hexrtne Storaw 'Tank O wxfl~w Date: -~ Consequence Dewription/Categnry Risk Tolerance Criteria (Category or Frequency) Initiating Event (typically n frequency) l.^."l."..,,.,... I... Enabling Event or Condition Conditional Modifiers (if applicable) Dcbcription ^- lank ti~erflow and rpixi (it hexane into dike In this methttd a spill into the tank dike, with little potential for ignition and rec-u!txng dnnmgr or lost production, is not s uonst~umce of interpsi. Nu Conseauence irf Interest Action rtyuirect Toletahle Arrival of tank truck with insufficient Freauencv af Unmil Meet Risk Tolerance depndf upon the nxganimtinn accepting the release of this matcrial

7 llxilllllll Appendix A. LOPA Summary Sheets for the Continuing Examples 197 TABLE A.5 Summary Sheet for Continuing Example la: Fatality Frequency Method (Method 3 of Chapter 3) Scenario > ,-&, 1 Equipment hiurnher z - h < a P A Scenario Title: I fexane Surtre Tank Qvrtflcsi~, i-- c Date: Consequence Descri pt ion/categary Risk Tolerance Criteria (Category or Frequency) I Initiating Event (typically a frequency) I *-- 1 Enabling Event or Condition an XPL a s it depend3 ted alarms. cannot be re i5 initiating event

8 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A.6 Summary Sheet for Continuing Example 1 b: Fatality Frequency Method (Method 3 of Chapter 3) -w Scenario Equipment Number i Scenaria Title: Wevane Surw Tank Overflorv v Spill contained by the dikt. p- Date: Consequence DevcrjptionfCatepry Description Kelec+.w of hexane inside the dike due to tank owrfktw with potential tor ignitiztn - <, Probability I (per year) Risk Taleranre Criteria (Category or Frequency) Initiating Event (ty@a!lly a frequency) _"" - 1 ~ Enabling Event or Condition Conditional Modifiers (if applicable) Maximum 'Ioleri~tdle Risk of rt Fatal injury Loop failure of BPCS LIC. (PFU from Tdbk 5 1) " " " " " Criteria Maintain dike as an 1PL (Inspection, maintenance, rtc.)

9 Appendix A. LOPA Summary Sheets for the Continuing Examples 199 TABLE A.7 Summary Sheet for Continuing Example 2a: Fatality Frequency Method (Method 3 of Chapter 3) 1 2 Number Date: : i Consequence Ddptian/Category i Risk Tolerance Criteria (Category or Frequency) initiating Event (typically a frequency) I 5~x11 not contained by the d& f Description - Kolew of hexane outside the dike due to tank overflow and failure of dike with wtential for ienition *, and fatalitv Mnximum Tolrrable Risk of a Serious Fire I Arrival of tank truck with insufficient room in the tank due to failure of &c* inventory control system. Frequency I Conditionat Modifiers 1 (if applicable) Robahilitv of ignition 1 g Independent Protection 1 Operator checks level hefore unloading I.,, I Layeis (e&ting) (PFD from TabIe 6.5) 1 Dike (existing) (PFD from Table 6.3) 1 1 x I It)-> Safeguiwds(non-IPLs) 1 RPCS level cnntrol and alarm is not an tp1 Risk Tolerance Criteria Met? (Yemo): Yes, with added SIF. I Criteria References (linke to originating hazard review, PFD, PRrID, dc.): i

10 200 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A.8 Summary Table for Continuing Example 2b: Fatality Frequency Method (Method 1 of Chapter 3) ----T-- Reledse of hexane IKlSjdf? the dike due to ' References (links to originating ba7,rd review, PFD, P&ID, etc.): I

11 Appendix A. LOPA Summary Sheets for the Continuing Examples 201 TABLE A.9 Summary Sheet for Continuing Example la: Required Number of lpls Method (Consequence severity classified by Fatality Frequency Method (Method 3 of Chapter 3).1 li! Risk Tolerance Criteria Met? (Yea): Yes, with added SIF. ble 8.2. This requirement contrvls the SIF requirement f

12 202 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A. 10 Summary Table for Continuing Example 1 b: Required Number of IPLs Method (Consequence severity classified by Fatality Frequency Method (Method 3 of Chapter 3) I Conscquence Dcscription/Category Risk Toleran 1 I Kelcase of hexant insidc the dike due to tanl, overflow with potential (or igiiitinn Conditional Modifiers (if applicable) Independent Protection, bit. (to he added -see Actions) Lavers I This requirement controls the S1F rcquiremml for this cxtarnplca LLOPA analyst (and team members, if applicable): "11 -x - -

13 TABLE A.11 Summary Sheet for Continuing Example 2a: Required Number of IPLs Method (Consequence severity classified by Fatality Frequency Method (Method 3 of Chapter 3), a total PFD of at least 1 x 1O-P must k ly 1 x 10-1 needs to be added, but require-

14 TABLE A. 12 Summary Sheet for Continuing Example 2b: Required Number of lpls Method (Consequence severity classified by Fatality Frequency Method (Method 3 of Chapter 3) ne Storage Spill contained by the dike Rate: Consequence DescdptioflCategory... Risk Tderance Criteria... (Category or Frequency) Initiating Event (typically a frequency) Enabling Event or Condition Conditional Modifiers (if applicable) Descrintion Kelrarr~ of hcwnc* inside the d tank owrflorv with potcnti.tl f arid fatality. See Table 8.7 Arriv'il of tank truck with insufficient rwrn 111 ttw tank due to failure of the in\rentvrp control system. Frequency based qm~ p1,tnt data, Add action items to action tracking detaba5e. As Frequency of Unmitigated Consequence IS Lwtwwxi 1 x 10-2 and 1 x lo-3,1.5 IPL cwdih art? rquired {Le., a tlttd I'bU of at ledst 1 x 10-3 / must be in place for all of the WLs). See X'abXc 8.3 s As onlv 0.S 1PL credit exist, an SIF with a BFU of 1 x l(1-2 tnust be added I This c&xols the design of the SIF system for this t-xarnplc. embers, if appiicablef: 204

15 Appendix A. LOPA Summary Sheets for the Continuing Examples 205 Table A. 13 Summary Sheet for Continuing Examples-Based on a Method from a Major Chemical Company The calculations shown on the pages that follow were performed by one company s proprietary software using the principles described in this book and that company s IPL PFD data and risk tolerance criteria. That information and the decision-making rules are embedded in the software and may not be explicitly shown in the table.

16 206 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A. 1 3 SAFETY/ENVIRONMENTAL RISK ASSESSMENT Location: CCPS Unit: Continuing Example Scenario Number: la Description of PHA Scenario: Hexane surge tank overflow - spill not contained by the dike List of Existing Safeguards Dike Risk Before Likelihood L Consequence: H Color: Yellow [denotes risk matrix grid] Risk After Likelihood LL Consequence: H Color: Blue [denotes risk matrix grid] Description of Recommended Mitigation Option@): Install an SIF Mitigation Option@) Accepted SIF installation Date of Analysis: Participants: Interlock Tag Number: Drawing Number: System Name: SIF Overview: Impact Event: Release of hexane (1,000-10,000 Ib) outside the dike due to tank overflow and failure of dike. Potentially life-threatening. Severity Category 4 Potential Consequence: H Initiating Cause BPCS Loop Failure, Latent Use 10-5 dangerous failures per hour for an operational loop. Enabling Conditions: Probability of operator being affected by scenario (i.e., in vicinity of spill) is assumed to be 0.5; further, probability of fatal injury is assumed to be 0.5 for affected operator. An ignition is assumed to occur so probability of ignition = 1. Probability of Enabling Conditions: E-01 *If the value is 1.0, NO Enabling Condition is considered. Unmitigated Likelihood: M-H 4.00E+01 Years Protection Layers (Not Final Defense) Group Layer Credit PFD Mitigation Systems Dikes-2 credits E-02 Protective Layer Descriptive Text: Human action not an IPL as it depends upon BPCS generated alarms. Cannot be used, as BPCS failure is initiating event. Total Credits 2 Intermediate Likelihood L 4.00E+03 Years Description SIF Mitigating Actions: SIF Mitigating Actions (Final Defense Instrumentation) Minimum Minimum Input output System Safety, Proactive Credits PFD Redundancy Redundancy Design Class IC DTT SIFClass: 1C SIL: 1 Final Mitigated Likelihood: LL 4.00E+04 Years

17 Appendix A. LOPA Summary Sheets for the Continuing Examples 207 TABLE A.13 (continued) Locution: CCPS Unit: Continuing Example Scenario Number: lb Description of PHA Scenario: Hexane surge tank overflow-spill contained by the dike List of Existing Safeguards: None Risk Before Likelihood L Consequence: H Color: Yellow [denotes risk matrix grid] Risk After Likelihood LL Consequence: H Color: Blue [denotes risk matrix grid] Description of Recommended Mitigation Option(s): Install an SIF Mitigation Option(s) Accepted SIF Installation Date of Analysis: Participants: Interlock Tag Number: Drawing Number: System Name: SIF Overview: Impact Event: Tank overflows and spill of hexane into dike. Spill into the tank dike results in less potential for ignition and the resultant potential personnel injury. Potentially life-threatening. Severity Category 4 Potential Consequence: H Initiating Cause: BPCS Loop Failure, Latent Use 10-5 dangerous failures per hour for an operational loop. Enabling Conditions: Probability of operator in dike is assumed to be = 0.1; probability of ignition is assumed to be = 0.1; probability of fatal injury is assumed to be = 0.5 Probability of Enabling Conditions: E-03 *If the value is 1.0, NO Enabling Condition is considered. Unmitigated Likelihood L 2.00E+03 Years Protection Layers (Not Final Defense) Group Layer Credit PFD N/A Protective Layer Descriptive Text: None as dike is not an IPL for release within dike. It contains the spill which is specified in the scenario description. Total Credits 0 Intermediate Likelihood L 2.00E+03 Years Description SIF Mitigating Actions: SIF Mitigating Actions (Final Defense Instrumentation) Minimum Minimum Input output System Safety, Proactive Credits PFD Redundancy Redundancy Design Class IC DTT SIFClass: IC SIL 1 Final Mitigated Likelihood LL 2.00E+04 Years

18 208 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A.13 (continued) Location: CCFS Unit: Continuing Example Scenario Number: 2a Description of PHA Scenario: Hexane storage tank overflow -spill not contained by the dike List of Existing Safeguards: LAHH and Operator check, dike Risk Before Likelihood L Consequence: H Color: Yellow [denotes risk matrix grid] Risk After Likelihood LL Consequence: H Color: Blue [denotes risk matrix grid] Description of Recommended Mitigation Option(s): Install an SIF Mitigation Option(s) Accepted SIF Installation Date of Analysis: Participants: Interlock Tag Number: Drawing Number: System Name: SIF Overview: Impact Event: Release of hexane (1,ooO to 10,000 lbs) outside the dike due to tank overflow and failure of dike. Potentially life-threatening. Severity Category 4 Potential Consequence: H Initiating Cause: Insufficient room in tank, failure of inventory control system. Arrival of tank truck with insufficient room in the tank due to failure of the inventory control system. Frequency of 1 per year based on plant data. Enabling Conditions: Probability of ignition is assumed to be = 1; probability of person in affected area is assumed to be = 0.5; probability of fatality given exposure is assumed to be = 0.5 Probability of Enabling Conditions: E-01 *If the value is 1.0, NO Enabling Condition is considered. Unmitigated Likelihood H 4.00E+00 Years Protection Layers (Not Final Defense) Group Layer Credit PFD Mitigation Systems Dike - 2 credits E-02 Instrumentation BPCS-Typical DCS E-01 Safeguarding Protective Layer Descriptive Text: BPCS level control and alarm is taken as one IPL which includes operator intervention based on the LAHH. Total Credits: 3 Intermediate Likelihood L 4.00E+03 Years Description SIF Mitigating Actions: SIF Mitigating Actions (Final Defense Instrumentation) Minimum Minimum Input output System Safety, Proactive Credits PFD Redundancy Redundancy Design Class IC loo DTT SIFClass: IC SIL 1 Final Mitigated Likelihood LL 4.00E+04 Years

19 Appendix A. LOPA Summary Sheets for the Continuing Examples 209 TABLE A.13 (continued) Location: CCPS Unit: Continuing Example Scenario Number: 2b Description of PHA Scenario: Hexane storage tank overflow -spill contained by the dike List of Existing Safeguards: LAHH and Operator intervention Risk Before Likelihood L Consequence: H Color: Yellow [denotes risk matrix grid] Risk After Likelihood LL Consequence: H Color: Blue [denotes risk matrix grid] Description of Recommended Mitigation Option($: Install an SIF Mitigation Option@) Accepted: SIF Installation Date of Analysis: Participants: Interlock Tag Number: Drawing Number: System Name: SIF Overview: Impact Event: Potentially life-threatening. Severity Category 4 Potential Consequence: H Initiating Cause: Overfill in dike, administrative failure. Arrival of tank truck with insufficient room in the tank due to failure of the inventory control system. Frequency of 1 per year based on plant data. Enabling Conditions: Probability of ignition = 0.1; probability of person in affected area = 0.1; probability of fatality given exposure = 0.5 Probability of Enabling Conditions: E-03 *If the value is 1.0, NO Enabling Condition is considered. Unmitigated Likelihood L-M 2.00E+02 Years Protection Layers (Not Final Defense) Group Layer Credit PFD Instrumentation BPCS-Typical DCS E-01 Safeguarding Protective Layer Descriptive Text: BPCS alarm is an IPL. Dike is not an IPL for release within dike. It contains the spill, which is specified in the scenario description. Total Credits: 1 Intermediate Likelihood L 2.00E+03 Years Description SIF Mitigating Actions: SIF Mitigating Actions (Final Defense Instrumentation) Minimum Minimum Input output System Safety, Proactive Credits PFD Redundancy Redundancy Design Class 1C DTT SIFClass: 1C SIL 1 Final Mitigated Likelihood LL 2.00E+04 Years

20 210 Appendix A. LOPA Summary Sheets for the Continuing Examples TABLE A. 13 (continued) CUMULATIVE FREQUENCY CONTINUING EXAMPLE The summed frequency of the four mitigated scenarios is approximately once per 6700 years or an annual frequency of 1.5 x This is achieved by the application of a SlFwith PFD of 1 x 10-1 (SIL1 in this company). The summed frequency is equivalent to the Boolean OR operation on the frequencies of the four scenarios. Although it is recognized that the OR function requires that the intersection of the four frequencies be subtracted from the sum of the frequencies; the difference is very small for numerically small frequencies. Also ignoring the intersection of the frequencies makes the cumulative frequency conservative. 1st Pass Evaluation of Unit Risk Added SIFs with PFD of 1 χ 10" 1 Scenario Unit Scenario MTBF, years 4.00E E E E+04 Frequency, per year 2.50E E E E E-04 To meet a risk criteria of 1 * KH/yr Added SIFs with PFD of 1 χ 10" 2 Unit MTBF, years 6.67E+03 or 6,667 Scenario Scenario MTBF, years Frequency, per year Unit MTBF, years 4.00E E E E E E E E-06 Unit 1.50E E+04 or 66,667 If the requirement is that the potentially life threatening scenarios occur with an annual frequency less than 1 χ 10-4, then a SlFwith PFD of 1 x 10 2 (SIL 2 in this company), would be required. The SIF would affect the summed frequency of the four scenarios (each equally) resulting in a mitigated frequency of approximately once every 67,000 years or an annual frequency of 1.5 x TABLE A. 14 Comparison of Results Required PFD for Added SIF Risk Matrix Fatality Frequency Required Number of IPLs Major Chemical Company Scenario la 1 x x x x 10-1 Scenario lb None No Consequence 1 x x x 10-1 Scenario 2a 1 x x x x lo-i Scenario 2b None - No Consequence 1 x x x lo-i