A formulation to optimize the risk reduction process based on LOPA

This paper presents a mixed integer nonlinear programming (MINLP) model to improve the computational use of the layer of protection analysis (LOPA). For a given set of independent protection layers to be implemented in a process, the proposed optimization model is solved to: a) Include costs associated with the different prevention, protection and mitigation devices, and b) Satisfy the risk level typically specified in the LOPA analysis through the occurrence probability. The underline purpose focuses on improving the analysis process and decision making to obtain the optimal solution in the safeguards selection that satisfies the requirements to be considered as IPL’s. The optimization is based on economic and risk tolerance criteria. As a first stage of this proposal, the safety instrumented system (SIS) design is optimized so that the selection of SIS components minimizes the risk and satisfies the safety integrity level (SIL) requirements. A case study is presented to validate the whole proposed approach.     

Layer of Protection Analysis – Quantifying human performance in initiating events and independent protection layers

Layer of Protection Analysis (LOPA) is widely used within the process industries as a simplified method to address risks and determine the sufficiency of protection layers. LOPA brings a consistent approach with added objectivity and a greater degree of understanding of the scenarios and risks as compared to purely qualitative studies such as Process Hazard Analyses. LOPA can be used to address a wide range of risk issues and serves as a highly effective aid to decision making.Incorporation of human performance within LOPA is recognized as an important, though often challenging, aspect of the analysis. The human role in potential initiating events or within human independent protection layers is important throughout the process industries, and becomes even more critical for batch processing facilities and in non-routine operations. The human role is key to process safety and the control of risks, necessitating the inclusion and quantification of human actions in independent protection layers for most companies. Human activities as potential initiating events and human performance within independent protection layers are reviewed and methods for quantification outlined. An extension into Human Reliability Analysis (HRA) is provided, including methods to develop Human Error Probabilities specific to the process safety culture and operations at a given plant site.     

基于风险矢量图的多场景保护层分析方法研究*

为解决多场景保护层分析（LOPA）存在的问题,建立风险矢量导图,将事故场景、独立保护层、修正因子、事故后果发生频率等因素进行系统分析,分别采用最大值法求和法计算后果发生频率,探讨多重初始事件导致事故发生频率的最优计算方法;阐述点火源、暴露因子以及致死概率等修正因子的使用方法并提出改进建议,避免常规LOPA下致死概率过高的问题。以柴油加氢装置原料油缓冲罐液位过高风险点为例,进行多场景LOPA,应用综合计算法得出多重初始事件导致的液位高后果失效频率为3.2E-02。结果表明:风险矢量导图和正确使用修正因子可有效提高LOPA的质量;不同初始事件导致的场景失效频率值相差较大或存在共用保护层的情况适用最大值法,其他情况则可采用求和法;如果多场景同时适用最大值法和求和法,则采用综合计算法;求和法过于保守,最大值法过于乐观,综合计算法更为准确。     

A fuzzy logic and probabilistic hybrid approach to quantify the uncertainty in layer of protection analysis

Layer of protection analysis (LOPA) is a widely used semi-quantitative risk assessment method. It provides a simplified and less precise method to assess the effectiveness of protection layers and the residual risk of an incident scenario. The outcome failure frequency and consequence of that residual risk are intended to be conservative by prudently selecting input data, given that design specification and component manufacturer's data are often overly optimistic. There are many influencing factors, including design deficiencies, lack of layer independence, availability, human factors, wear by testing and maintenance shortcomings, which are not quantified and are dependent on type of process and location. This makes the risk in LOPA usually overestimated. Therefore, to make decisions for a cost-effective system, different sources and types of uncertainty in the LOPA model need to be identified and quantified. In this study, a fuzzy logic and probabilistic hybrid approach was developed to determine the mean and to quantify the uncertainty of frequency of an initiating event and the probabilities of failure on demand (PFD) of independent protection layers (IPLs). It is based on the available data and expert judgment. The method was applied to a distillation system with a capacity to distill 40 tons of flammable n-hexane. The outcome risk of the new method has been proven to be more precise compared to results from the conventional LOPA approach.     

ExSys-LOPA for the chemical process industry

The chemical process industries are characterized by the use, processing, and storage of large amounts of dangerous chemical substances and/or energy. Among different missions of chemical plants there are two very important ones, which: 1. provide a safe work environment, 2. fully protect the environment. These important missions can be achieved only by design of adequate safeguards for identified process hazards. Layer of Protection Analysis (LOPA) can successfully answer this question. This technique is a simplified process of quantitative risk assessment, using the order of magnitude categories for initiating cause frequency, consequence severity, and the likelihood of failure of independent protection layers to analyze and assess the risk of particular accident scenarios. LOPA requires application of qualitative hazard evaluation methods to identify accident scenarios, including initiating causes and appropriate safeguards. This can be well fulfilled, e.g., by HAZOP Studies or What-If Analysis. However, those techniques require extensive experience, efforts by teams of experts as well as significant time commitments, especially for complex chemical process units. In order to simplify that process, this paper presents another strategy that is a combination of an expert system for accident scenario identification with subsequent application of LOPA. The concept is called ExSys-LOPA, which employs, prepared in advance, values from engineering databases for identification of loss events specific to the selected target process and subsequently a accident scenario barrier model developed as an input for LOPA. Such consistent rules for the identification of accident scenarios to be analyzed can facilitate and expedite the analysis and thereby incorporate many more scenarios and analyze those for adequacy of the safeguards. An associated computer program is under development. The proposed technique supports and extends the Layer of Protection Analysis application, especially for safety assurance assessment of risk-based determination for the process industries. A case study concerning HF alkylation plant illustrates the proposed method.     

Integration of process control protection layer into a simulation-based HAZOP tool

This paper discusses the framework methodology behind the proposed simulation-based HAZOP tool. Simulation-based approach is one of the many ways to support conventional HAZOP by its automation. Compared to knowledge-based and other approaches, a HAZOP software tool based on deviations simulation is able to examine the investigated process more into detail and so find root causes of hazardous consequences. Another advantage is the ability to identify also potential hazards which did not occur in the past and might be overlooked. The presented framework methodology uses a layer of protection analysis (LOPA) concept of independent protection layers (IPLs) testing. Control system integrated into the raw process design represents the first of various protection layers of the LOPA concept. As a case study, a CSTR chemical production with nonlinear behavior under Proportional-Integral-Derivative (PID) actions as the predominant type of classical feedback control strategy is used. The presented tool identifies hazardous regimes under conditions when control loop introduces hazardous consequences or even acts synergically with existing hazardous events. Risk derived from different consequences is ranked by the risk assessment matrix (RAM) as a part of the conventional quantitative HAZOP study.     

Bayesian networks make LOPA more effective,QRA more transparent and flexible,and thus safety more definable!

Quantitative risk analysis is in principle an ideal method to map one’s risks, but it has limitations due to the complexity of models, scarcity of data, remaining uncertainties, and above all because effort, cost, and time requirements are heavy. Also, software is not cheap, the calculations are not quite transparent, and the flexibility to look at various scenarios and at preventive and protective options is limited. So, the method is considered as a last resort for determination of risks. Simpler methods such as LOPA that focus on a particular scenario and assessment of protection for a defined initiating event are more popular. LOPA may however not cover the whole range of credible scenarios, and calamitous surprises may emerge.In the past few decades, Artificial Intelligence university groups, such as the Decision Systems Laboratory of the University of Pittsburgh, have developed Bayesian approaches to support decision making in situations where one has to weigh gains and costs versus risks. This paper will describe details of such an approach and will provide some examples of both discrete random variables, such as the probability values in a LOPA, and continuous distributions, which can better reflect the uncertainty in data.     

HAZOP-LOPA方法与SIL定级在电镀废水处理中的应用

为了保证电镀废水处理工艺的安全性,首先采用危险与可操作性分析(HAZOP)方法定性辨识工艺中潜在的危险和危害,并提出安全对策措施;然后采用保护层分析(LOPA)方法定量计算现有保护措施是否能够将风险控制在可接受范围;如果风险较高,通过增加安全仪表等级(SIL)降低风险值。并通过实例分析证明HAZOP-LOPA分析方法能够有效地实现电镀废水处理工艺的风险评价。     

石化装置火灾爆炸贝叶斯网络与防护层集成分析

复杂的石油化工装置在运转过程中存在诸多不确定因素,易发生火灾、爆炸等重大事故,给安全生产带来极大威胁。考虑到传统的系统安全分析方法在风险评估中存在一定局限性,引入贝叶斯网络与防护层集成分析模型。应用GeNIe软件将系统故障树转成贝叶斯网络,根据贝叶斯双向推理进行故障预测和诊断,快速识别系统薄弱环节并确定为风险贝叶斯故障节点,结合防护层分析提出相应的独立防护层,确定剩余风险水平。实例应用表明,所构建的贝叶斯网络与防护层集成分析模型对复杂系统进行风险评估是可行的,较传统的事件树、故障树分析方法更加科学、合理。     

过程工业计算机辅助安全防护层分析技术进展

介绍当前过程工业安全防护层分析(LOPA)的基本内容,研讨LOPA方法与深层次的危险和可操作性分析方法(HAZOP)之间的关系以及计算机辅助HAZOP的研究进展。针对人工LOPA方法的缺点,开发了SDG-HAZOP软件平台,为计算机辅助LOPA平台研发创造了先决条件。应用计算机辅助LOPA方法,使防护层的设置具有更好的针对性、合理性和有效性,发挥对事故的预防和预警作用,并具有良好的发展前景。     

HAZOP分析中LOPA的应用研究

通过分析危险与可操作性研究(HAZOP)方法的不足和保护层分析(LOPA)方法的功能,提出将LOPA融入HAZOP分析中,能进一步提高HAZOP的事故预防能力和丰富HAZOP的分析结果。介绍LOPA基本方法,阐述LOPA融入HAZOP的机理、衔接关系及分析步骤,并通过一个化工工艺流程危险性分析实例说明LOPA的作用及如何将LOPA融入HAZOP分析中。结果表明:在HAZOP分析中融入LOPA方法,能实现对现有保护措施的可靠性进行量化评估,确定其消除或降低风险的能力,从而寻求是否需要附加减少风险的安全保护措施。     

Fuzzy logic for piping risk assessment (pfLOPA)

This paper explores the application of the fuzzy logic for risk assessment of major hazards connected with transportation of flammable substances in long pipelines. As a basis for risk assessment, the framework of the fuzzy Layer of Protection Analysis (fLOPA) was used. fLOPA presents a new approach to risk assessment based on two assumptions: 1. different effects of the layer of protection functions on particular elements of the risks (frequency and severity of consequence), and 2. the application of fuzzy logic system (FLS) composed of three elements: fuzzification, inference process and defuzzification. A further calculation follows LOPA methodology with the use of fuzzy logic system where fuzzy risk matrix is used for risk assessment. A typical case study comprising section of a long pipeline failure is performed and a comparison between the classical LOPA approach and fuzzy approach is made.     

基于LOPA逻辑的罐区多米诺效应定量风险评估*

为了更好地降低化工企业罐区事故造成多米诺效应的风险,提出1种基于保护层分析（LOPA）的定量风险评估程序。首先,阐述基于保护层分析(LOPA)逻辑的多米诺定量风险评估流程,即引入包括可用性、有效性及3种逻辑门定义及量化的安全屏障定量评估;然后,利用LOPA的分析逻辑将安全屏障融入多米诺定量风险评估框架中;最后,选取2×2 000 m3苯乙烯罐区为对象,识别防火层与喷淋冷却系统2种安全屏障并开展基于LOPA逻辑的罐区多米诺效应定量风险评估,得出安全屏障能有效地降低多米诺事故发生频率及罐区个人风险的结论。研究结果表明:该分析方法可为化工企业开展多米诺效应定量风险评估提供参考。     

Determining a realistic ranking of the most dangerous process equipment of the ammonia production process: A practical approach

OCI Nitrogen seeks to gain knowledge of (leading) indicators regarding the process safety performance of their ammonia production process. The current research determines the most dangerous process equipment by calculating their effects resulting from a loss of containment using DNV GL's Phast™ dispersion model. In this paper, flammable and toxic effects from a release from the main equipment of an ammonia plant have been calculated. Such an encompassing approach, which can be carried out for an entire plant, is innovative and has never been conducted before. By using this model, it has been demonstrated that the effects arising from an event of failure are the largest in process equipment containing pressurized synthesis gas and ‘warm’ liquid ammonia, meaning the ammonia buffer tanks, ammonia product pumps, and the ammonia separator. Most importantly, this document substantiates that it is possible to rank the most hazardous process equipment of the ammonia production process based on an adverse impact on humans using the calculated effect distance as a starting point for a chance of death of at least 95%. The results from the effect calculations can be used for risk mapping of an entire chemical plant or be employed and applied in a layer of protection analysis (LOPA) to establish risk mitigation measures.     

3-Parameters SPW technique: A new method for evaluation of target safety integrity level

Introduced by IEC-61508 standard, safety integrity levels (SIL) have been used for assessing the reliability of safety instrumented functions (SIF) for protection of the system under control in abnormal conditions. Different qualitative, semi-qualitative and quantitative methods have been proposed by the standard for establishing target safety integrity levels amongst which “Risk Graph” has gained wide attention due to its simplicity and easy-to-apply characteristics. However, this method is subject to many deficiencies that have forced industry men and experts to modify it to fit their demands. In this paper, a new modification to risk graph parameters has been proposed that adds more flexibility to them and reduces their subjective uncertainties but keeps the method as simple as before. Three parameters, namely severity (S), hazard avoidance probability (P), and demand rate (W) are used instead of former four parameters. Hence, the method is named SPW. The outcome results of this method can be directly converted to probability of failure on demand (PFD) or risk reduction factor (RRF). The proposed method has been tested on an example case that has been studied before with conventional risk graph and LOPA techniques. The results show that new method agrees well with LOPA and reduces costs imposed by conservative approximations assumed during application of conventional risk graph.     

基于模糊保护层的池火灾事故风险分析

为计算引发池火灾事故的风险值,提高事故风险的量化水平,判断现有风险控制措施是否满足风险容忍度的要求,为制定减缓风险措施提供依据,给出了新的池火灾风险评估模型。基于传统的保护层分析模型(LOPA),结合模糊集合理论,引入模糊风险矩阵进行风险评估,构建适用于引发池火灾事故的模糊保护层(fL OPA)风险分析模型。该模型的特点是将模糊逻辑和保护层分析结合,减少了传统保护层分析方法计算过程中的不确定性因素,引入严重度减少指数(SRI)概念,使严重度计算、风险评估更加准确。运用该模型对原油储罐泄漏池火灾事故风险进行分析,给出风险决策方案,判断现有保护措施是否能控制风险在可容忍范围内,实例验证了模型的可行性。     

Integrating cybersecurity in hazard and risk analyses

As operational and information technologies converge to allow for remote and real-time access to plant operating data and control functions, the process industry could become increasingly susceptible to cyber-attacks. Traditional hazard and risk analysis methods appear inadequate to identify, prevent, and mitigate such attacks. This paper discusses the significance of incorporating cybersecurity vulnerability analysis not just as part of process hazard analysis (PHA), but also in terms of protecting the process control network and implementing adequate safeguards in general against cyber threats. A layer of protection analysis (LOPA) is adapted to evaluate potential weaknesses and ensure safeguards for critical applications would be resistant to cyber-attacks. Integrating cybersecurity into hazard and risk analyses as well as other elements of process safety management (PSM) is demonstrated with examples, making the plant more resilient against both traditional and cyber threats.     

SIL determination: Recognising and handling high demand mode scenarios

The International Standards for Functional Safety (IEC 61508 and IEC 61511) are well recognised and have been adopted globally in many of the industrialised countries during the past 10 years or so. Conformance with these standards involves determination of the requirements for instrumented risk reduction measures, described in terms of a safety integrity level (SIL). During this period within the process sector, layer of protection analysis (LOPA) has become the most widely used approach for SIL determination. Experience has identified that there is a type of hazardous event scenario that occurs within the process sector that is not well recognised by practitioners, and is therefore not adequately handled by the standard LOPA approach. This is when the particular scenario places a high demand rate on the required safety instrumented function. This paper will describe how to recognise a high demand rate scenario. It will discuss what the standards have to say about high demand rates. It will then demonstrate how to assess this type of situation and provide a case study example to illustrate how to determine the necessary integrity level. It will conclude by explaining why it is important to treat high demand rate situations in this way and the resulting benefit of a lower but sufficient required integrity level.     

Got a risk reduction strategy?

Process safety can be viewed as part of a triad that supports safety in a petrochemical facility. The other two parts are OSHA-type people safety (slips, falls, etc.) and industrial hygiene. The paper will look at process safety from a top down, plant centric view. Process safety can be distilled down to the basic concept of risk reduction. If we reduce risk, our facility will be safer. The obvious problem is that we have potential risks everywhere so how are we going to reduce all these risks to an acceptable level. Clearly we need a strategy or to use a less fancy word – a plan.Too many times it is easy to concentrate on certain aspects such as safety instrumented systems (SIS), layer of protection analysis (LOPA), behavioral safety, prevention, etc. and lose track of the whole picture of what risk reduction entails in a plant.This paper will look at risk reduction in a facility from a plant viewpoint and will cover the details and concepts of risk reduction across a wide spectrum of plant functionalities – safety climate and culture, process safety management, mechanical integrity and risk, layers of protection in risk reduction, loss of containment/hazard relationship, the risk reduction bow-tie diagram, developing a risk reduction strategy, risk reduction strategy elements, and sustainability.It will also discuss some key concepts in dealing with risk reduction in general.     

Advanced process control system with MPC as a new approach for layer of protection analysis

Layer of protection analysis (LOPA) is a widely used method to support process safety in the chemical industries. In the LOPA, the process is classified into many layers, one of such layers considers the basic process control system (BPCS) which commonly uses PID controllers. This kind of controllers cannot deal with constraints. For this reason, the main purpose of this work is to provide a framework to enhance the control layer in the LOPA, which consists of a model predictive control (MPC) with safety features. These features include: sublayers in the controller system (such as real time optimization, target calculation, and MPC), safety constraints, and guarantee of stability by adopting an Infinite Horizon MPC (IHMPC). Here, we propose an approach for control-inspired view to process safety, replacing the BPCS by an Advanced Process Control System (APCS). Moving forward with these concepts, first, a literature review emphasizes the content, showing two perspectives for the APCS. The APCS is designed for two varieties of controllers, a basic IHMPC and IHMPC with zone control to compare the performance. In this framework, the first sublayer consists of a real time optimization (RTO) structure, that calculates the optimal operating condition for the process controller, which computes the control action. Besides, RTO has an additional constraint called the safety index, based on the protection of process operational. RTO and basic IHMPC communicate directly, while for IHMPC with zone control there is an inner sublayer called Target Calculation, it computes a feasible target to the controller, working as another safety strategy in APCS. After that, we demonstrate both structures applied to a CSTR reactor. From the case study, we compared both controllers, and evaluated the effect that the safety index constraint causes in the setpoints, outputs, and control actions. The use of safety constraint in RTO proved to be a safe strategy for the control layer, as well as IHMPC with zone control presented a safer profile than basic IHMPC. Furthermore, the results show that safety constraint affect the economic goal, decreasing its value.