Simplified Risk Analysis Layer of Protection Analysis (LOPA)

Transcription

1 Paper 281a Smplfed Rsk Analyss Layer of Protecton Analyss (LOPA) Arthur M. (Art) Dowell, III, P.E. Senor Techncal Fellow Hazard Analyss Rohm and Haas Company Deer Park, TX Denns C. Hendershot Senor Techncal Fellow Hazard Analyss Rohm and Haas Company Brstol, PA Prepared for Presentaton at the Amercan Insttute of Chemcal Engneers 2002 Natonal Meetng Indanapols, IN November 3-8, 2002 Paper 281a Copyrght Rohm and Haas Company August 29, 2002 UNPUBLISHED AIChE shall not be responsble for statements or opnons contaned n papers or prnted n ts publcatons.

2

3 Paper 281a Page 1 of 6 Smplfed Rsk Analyss Layer of Protecton Analyss (LOPA) Arthur M. (Art) Dowell, III, P.E. Rohm and Haas Company Deer Park, TX Denns C. Hendershot Rohm and Haas Company Brstol, PA ABSTRACT LOPA (Layer of Protecton Analyss) s a smplfed rsk assessment tool that s unquely useful for determnng how strong the desgn should be for a SIF (Safety Instrumented Functon nterlock ). LOPA s a sem-quanttatve tool that can estmate the requred PFD (probablty of falure on demand) for a SIF. It s readly appled after the Process Hazard Analyss (PHA) for example, HAZOP and before Fault Tree Analyss/Quanttatve Rsk Assessment. In most cases, the SIF Safety Integrty Level requrements can be determned by LOPA wthout usng the more tme-consumng tools of Fault Tree Analyss/Quanttatve Rsk Assessment. The tool s selfdocumentng. INTRODUCTION In the 1990s, companes and ndustry groups developed standards to desgn, buld, and mantan Safety Instrumented Systems (SIS) (1, 2, 3). A key nput for the tools and technques requred to mplement these standards was the requred Probablty of Falure on Demand (PFD) for each Safety Instrumented Functon (SIF). Process Hazard Analyss (PHA) teams and project teams struggled to determne the requred Safety Integrty Level (SIL) for the SIFs ( nterlocks ) (4). The concept of layers of protecton and an approach to analyze the number of layers needed was frst publshed by the Center for Chemcal Process Safety (CCPS) n the 1993 book Gudelnes for Safe Automaton of Chemcal Processes (1). From those concepts, several companes developed nternal procedures for Layer of Protecton Analyss (LOPA) (5), and, n 2001 CCPS publshed a book descrbng LOPA (6). Ths paper brefly descrbes the LOPA process, and dscusses experence n mplementng the technque. WHAT IS LOPA? LOPA s a sem-quanttatve rsk analyss technque that s appled followng a qualtatve hazard dentfcaton tool such as HAZOP. We descrbe LOPA as sem-quanttatve because the technque does use numbers and generate a numercal rsk estmate. However, the numbers are selected to conservatvely estmate falure probablty, usually to an order of magntude level of accuracy, rather than to closely represent the actual performance of specfc equpment and devces. The result s ntended to be conservatve (overestmatng the rsk), and s usually adequate to understand the requred SIL for the SIFs. If a more complete understandng of the rsk s requred, more rgorous quanttatve technques such as fault tree analyss or quanttatve rsk analyss may be requred.

4 Paper 281a Page 2 of 6 LOPA starts wth an undesred consequence usually, an event wth envronmental, health, safety, busness, or economc mpact. The general format of a LOPA table s shown n Table 1. Table 1: General Format of LOPA Table Consequence & Severty Intatng Event (Cause) Intatng Event Challenge Frequency Preventve Independent Protecton Layers Probablty of Falure on Demand (PFD) Mtgaton Independent Protecton Layers Mtgated Consequence Frequency /yr. Process Desgn BPCS (DCS) Operator Response to Alarms SIF (PLC relay) (PFD) /yr. The severty of the consequence s estmated usng approprate technques, whch may range from smple look up tables to sophstcated consequence modelng software tools. One or more ntatng events (causes) may lead to the consequence; each cause-consequence par s called a scenaro. LOPA focuses on one scenaro at tme. The frequency of the ntatng event s estmated (usually from look-up tables or hstorcal data). Each dentfed safeguard s evaluated for two key characterstcs: Is the safeguard effectve n preventng the scenaro from reachng the consequence? AND, s the safeguard ndependent of the ntatng event and the other IPLs (Independent Protecton Layers)? If the safeguard meets BOTH of these tests, t s an IPL. LOPA estmates the lkelhood of the undesred consequence by multplyng the frequency of the ntatng event by the product of the PFDs for the applcable IPLs usng Equaton 1 (6). Where f C = f I I J j= 1 PFD 1 j = f PFD PFD K PFD 2 J C f = frequency for consequence C for ntatng event I f = ntatng event frequency for ntatng event PFD j = probablty of falure on demand of the jth IPL that protects aganst consequence C for ntatng event. (1) Typcal ntatng event frequences, and IPL PFDs are gven by Dowell (4, 5, 7) and CCPS (6). Fgure 1 llustrates the concept of LOPA that each IPL acts as a barrer to reduce the frequency of the consequence. Fgure 1 also shows how LOPA compares to event tree analyss. A LOPA analyss descrbes a sngle path through an event tree, as shown by the heavy lne n Fgure 1. The result of the LOPA s a rsk measure for the scenaro an estmate of the lkelhood AND consequence. Ths estmate can be consdered a mtgated consequence frequency the frequency s mtgated by the ndependent layers of protecton. The rsk estmate can be compared to company crtera for tolerable rsk for that partcular consequence severty. If addtonal rsk reducton s needed, more IPLs must be added to the desgn. Another opton mght be to redesgn the process perhaps consderng nherently safer desgn alternatves (8, 9).

5 Paper 281a Page 3 of 6 Fgure 1: Comparson between LOPA and event tree analyss [Copyrght 2001, AIChE, reproduced by permsson] Frequently, the IPLs nclude SIFs. One product of the LOPA analyss s the requred PFD of the SIF, thus defnng the requred SIL for that SIF. Wth the SIL defned, ANSI/ISA (2), IEC (3), and, when fnalzed, draft IEC (11) should be used to desgn, buld, commsson, operate, test, mantan, and decommsson the SIF. IMPLEMENTING LOPA Some mportant consderatons and experence n mplementng LOPA are dscussed by Dowell (11), and these are summarzed brefly below. A greatly expanded dscusson of these ponts can be found n the orgnal reference. Team Makeup Some organzatons conduct LOPA as a part of the PHA revew, usng the PHA team. Ths can be effcent because the team s famlar wth the scenaro and decsons can be recorded as part of the PHA recommendatons. Ths approach works best when the rsk tolerance crtera are appled to each scenaro ndvdually. Other companes have found t to be more effcent to capture the lst of potental LOPA scenaros durng the PHA, for later evaluaton by a smaller team (perhaps just a process engneer and a person sklled n LOPA). The LOPA team may then report back to the PHA team on the results of ther evaluaton. Ether approach may be used successfully. The mportant factor s that the process knowledge s ncorporated n the LOPA and that the LOPA methodology s appled correctly and consstently. One Cause One Consequence = One Scenaro. It s crtcal that each LOPA scenaro have only one cause and one consequence. Users may be tempted to combne causes that lead to the same consequence to save tme n the analyss and documentaton. Unfortunately, each IPL may not protect aganst each ntatng event. For example, a SIF that blocks the feed flow nto a reactor protects aganst hgh

6 Paper 281a Page 4 of 6 pressure from the feed streams, but ths SIF does not protect aganst hgh pressure caused by nternal reacton. It s mportant each canddate IPL be evaluated for ts effectveness aganst a sngle ntatng event leadng to a sngle consequence. Understandng what consttutes an IPL. An IPL s a devce, system, or acton that s capable of preventng a scenaro from proceedng to ts undesred consequence ndependent of the ntatng event or the acton of any other layer of protecton assocated wth the scenaro. The effectveness and ndependence of an IPL must be audtable. All IPLs are safeguards, but not all safeguards are IPLs. Each safeguard dentfed for a scenaro must be tested for conformance wth ths defnton. The followng keywords may be helpful n evaluatng an IPL: o The three Ds help determne f a canddate s an IPL: Detect Most IPLs detect or sense a condton n the scenaro. Decde Many IPLs make a decson to take acton or not. Deflect All IPLs deflect the undesred consequence by preventng t. o The four Enoughs help evaluate the effectveness of a canddate IPL: Bg Enough? Fast Enough? Strong Enough? Smart Enough? o The Bg I Remember that the IPL must be ndependent of the ntatng event and all other IPLs. Understandng Independence. A crtcal ssue for LOPA s determnng whether IPLs are ndependent from the ntatng event and from each other. The LOPA methodology s based on the assumpton of ndependence. If there are common mode falures among the ntatng event and IPLs, the LOPA wll underestmate the rsk for the scenaro. Dowell (11) and CCPS (6) dscuss how to ensure ndependence, and provde several useful examples. Procedures and Inspectons. Procedures and nspectons cannot be counted as IPLs. They do not have the ablty to detect the ntatng event, cannot make a decson to take acton, and cannot take acton to prevent the consequence. Inspectons and tests of the IPL do not count as another IPL. They do affect the PFD of the IPL. Mtgatng IPLs. An IPL may prevent the consequence dentfed n the scenaro, but, through ts proper functonng, t may generate another less severe, but stll undesrable, consequence. A rupture dsk on a vessel s an example. It prevents overpressurzaton of the vessel (although not 100% of the tme the rupture dsk does have a PFD). However, the proper operaton of the rupture dsk results n a loss of contanment from the vessel to the envronment or a contanment or treatment system. Ths best way do deal wth ths stuaton s to create another LOPA scenaro to estmate the frequency of the release through the rupture dsk, ts consequence, and then determne f t meets the rsk tolerance crtera.

7 Paper 281a Page 5 of 6 Beyond LOPA. Some scenaros or groups of scenaros are too complex for LOPA. A more detaled rsk assessment tool such as event tree analyss, fault tree analyss, or quanttatve rsk analyss s needed. Some examples where ths mght be true nclude: o A system that has shared components between the ntatng event and canddate IPLs, and no cost effectve way of provdng ndependence. Ths system volates the LOPA requrement for ndependence between ntatng event and IPLs. o A large complex system wth many LOPA scenaros, or a varety of dfferent consequences mpactng dfferent populatons. Ths system may be more effectvely analyzed and understood usng quanttatve rsk analyss. Rsk Crtera. Implementaton of LOPA s easer f an organzaton has defned rsk tolerance crtera. It s very dffcult to make rsk based decsons wthout these crtera, whch are used to decde f the frequency of the mtgated consequence (wth the IPLs n place) s low enough. CCPS (6) provdes gudance and references on how to develop and use rsk crtera. Consstency. When an organzaton mplements LOPA, t s mportant to establsh tools, ncludng ads lke look-up tables for consequence severty, ntatng event frequency, and PFD for standard IPLs. The calculaton tools must be documented, and users traned. All LOPA practtoners n an organzaton must use the same rules n the same way to ensure consstent results (6). CONCLUSION Process safety engneers and SIL assgnment teams from many companes have concluded that LOPA s an effectve tool for SIL assgnment. LOPA requres fewer resources and s faster than fault tree analyss or quanttatve rsk assessment. If more detaled analyss s needed, the LOPA scenaros and canddate IPLs provde an excellent startng pont. LOPA has the followng advantages: Focuses on severe consequences Consders all the dentfed ntatng causes, Encourages system perspectve Confrms whch IPLs are effectve for whch ntatng causes Allocates rsk reducton resources effcently Provdes clarty n the reasonng process, Documents everythng that was consdered, Improves consstency of SIL assgnment Offers a ratonal bass for managng IPLs n an operatng plant REFERENCES 1. Center for Chemcal Process Safety (CCPS), Gudelnes for Safe Automaton of Chemcal Processes, Amercan Insttute of Chemcal Engneers, New York, NY, The Instrumentaton, Systems, and Automaton Socety (ISA), ANSI/ISA , Applcaton of Safety Instrumented Systems to the Process Industres, The Instrumentaton, Systems, and Automaton Socety, Research Trangle Park, NC, 1996.

8 Paper 281a Page 6 of 6 3. Internatonal Electrotechncal Commsson, IEC 61508, Functonal Safety of Electrcal / Electronc / Programmable Electronc Safety-related Systems, Parts 1-7, Geneva: Internatonal Electrotechncal Commsson, Dowell, A. M., III, Layer of Protecton Analyss for Determnng Safety Integrty Level, ISA Transactons , Dowell, A. M., III, Layer of Protecton Analyss: A New PHA Tool, After HAZOP, Before Fault Tree Analyss, Presented at Center for Chemcal Process Safety Internatonal Conference and Workshop on Rsk Analyss n Process Safety, Atlanta, GA, October 21, 1997, Amercan Insttute of Chemcal Engneers, New York, NY, Center for Chemcal Process Safety (CCPS), Layer of Protecton Analyss, Smplfed Process Rsk Assessment, Amercan Insttute of Chemcal Engneers, New York, NY, Dowell, A. M., III Layer of Protecton Analyss A Worked Dstllaton Example ISA Tech/1999, Phladelpha PA, The Instrumentaton, Systems, and Automaton Socety, Research Trangle Park, NC, Center for Chemcal Process Safety (CCPS), Inherently Safer Chemcal Processes: A Lfe Cycle Approach, Amercan Insttute of Chemcal Engneers, New York, NY, Dowell, A. M., III Layer of Protecton Analyss and Inherently Safer Processes, Process Safety Progress, 18, 4, , Internatonal Electrotechncal Commsson, IEC 61511, Functonal Safety Instrumented Systems for the Process Industry Sector, Parts 1-3, Internatonal Electrotechncal Commsson, Geneva, Draft n Progress. 11. Dowell, A. M., III Layer of Protecton Analyss: Lessons Learned. ISA Techncal Conference Seres: Safety Instrumented Systems for the Process Industry, May 14-16, 2002, Baltmore, MD. NOMENCLATURE AIChE BPCS CCPS DCS HAZOP IEC IPLs ISA LOPA PFD PHA PLC SIF SIL SIS Amercan Insttute of Chemcal Engneers Basc Process Control System Center for Chemcal Process Safety Dstrbuted Control System Hazard and Operablty Analyss Internatonal Electrotechncal Commsson Independent Protecton Layer The Instrumentaton, Systems, and Automaton Socety Layer of Protecton Analyss Probablty of Falure on Demand Process Hazard Analyss Programmable Logc Controller Safety Instrumented Functon Safety Integrty Level Safety Instrumented System