ExSys-LOPA for the chemical process industry

The chemical process industries are characterized by the use, processing, and storage of large amounts of dangerous chemical substances and/or energy. Among different missions of chemical plants there are two very important ones, which: 1. provide a safe work environment, 2. fully protect the environment. These important missions can be achieved only by design of adequate safeguards for identified process hazards. Layer of Protection Analysis (LOPA) can successfully answer this question. This technique is a simplified process of quantitative risk assessment, using the order of magnitude categories for initiating cause frequency, consequence severity, and the likelihood of failure of independent protection layers to analyze and assess the risk of particular accident scenarios. LOPA requires application of qualitative hazard evaluation methods to identify accident scenarios, including initiating causes and appropriate safeguards. This can be well fulfilled, e.g., by HAZOP Studies or What-If Analysis. However, those techniques require extensive experience, efforts by teams of experts as well as significant time commitments, especially for complex chemical process units. In order to simplify that process, this paper presents another strategy that is a combination of an expert system for accident scenario identification with subsequent application of LOPA. The concept is called ExSys-LOPA, which employs, prepared in advance, values from engineering databases for identification of loss events specific to the selected target process and subsequently a accident scenario barrier model developed as an input for LOPA. Such consistent rules for the identification of accident scenarios to be analyzed can facilitate and expedite the analysis and thereby incorporate many more scenarios and analyze those for adequacy of the safeguards. An associated computer program is under development. The proposed technique supports and extends the Layer of Protection Analysis application, especially for safety assurance assessment of risk-based determination for the process industries. A case study concerning HF alkylation plant illustrates the proposed method.     

A fuzzy logic and probabilistic hybrid approach to quantify the uncertainty in layer of protection analysis

Layer of protection analysis (LOPA) is a widely used semi-quantitative risk assessment method. It provides a simplified and less precise method to assess the effectiveness of protection layers and the residual risk of an incident scenario. The outcome failure frequency and consequence of that residual risk are intended to be conservative by prudently selecting input data, given that design specification and component manufacturer's data are often overly optimistic. There are many influencing factors, including design deficiencies, lack of layer independence, availability, human factors, wear by testing and maintenance shortcomings, which are not quantified and are dependent on type of process and location. This makes the risk in LOPA usually overestimated. Therefore, to make decisions for a cost-effective system, different sources and types of uncertainty in the LOPA model need to be identified and quantified. In this study, a fuzzy logic and probabilistic hybrid approach was developed to determine the mean and to quantify the uncertainty of frequency of an initiating event and the probabilities of failure on demand (PFD) of independent protection layers (IPLs). It is based on the available data and expert judgment. The method was applied to a distillation system with a capacity to distill 40 tons of flammable n-hexane. The outcome risk of the new method has been proven to be more precise compared to results from the conventional LOPA approach.     

HAZOP分析中LOPA的应用研究

通过分析危险与可操作性研究(HAZOP)方法的不足和保护层分析(LOPA)方法的功能,提出将LOPA融入HAZOP分析中,能进一步提高HAZOP的事故预防能力和丰富HAZOP的分析结果。介绍LOPA基本方法,阐述LOPA融入HAZOP的机理、衔接关系及分析步骤,并通过一个化工工艺流程危险性分析实例说明LOPA的作用及如何将LOPA融入HAZOP分析中。结果表明:在HAZOP分析中融入LOPA方法,能实现对现有保护措施的可靠性进行量化评估,确定其消除或降低风险的能力,从而寻求是否需要附加减少风险的安全保护措施。     

Bayesian networks make LOPA more effective,QRA more transparent and flexible,and thus safety more definable!

Quantitative risk analysis is in principle an ideal method to map one’s risks, but it has limitations due to the complexity of models, scarcity of data, remaining uncertainties, and above all because effort, cost, and time requirements are heavy. Also, software is not cheap, the calculations are not quite transparent, and the flexibility to look at various scenarios and at preventive and protective options is limited. So, the method is considered as a last resort for determination of risks. Simpler methods such as LOPA that focus on a particular scenario and assessment of protection for a defined initiating event are more popular. LOPA may however not cover the whole range of credible scenarios, and calamitous surprises may emerge.In the past few decades, Artificial Intelligence university groups, such as the Decision Systems Laboratory of the University of Pittsburgh, have developed Bayesian approaches to support decision making in situations where one has to weigh gains and costs versus risks. This paper will describe details of such an approach and will provide some examples of both discrete random variables, such as the probability values in a LOPA, and continuous distributions, which can better reflect the uncertainty in data.     

Layer of Protection Analysis – Quantifying human performance in initiating events and independent protection layers

Layer of Protection Analysis (LOPA) is widely used within the process industries as a simplified method to address risks and determine the sufficiency of protection layers. LOPA brings a consistent approach with added objectivity and a greater degree of understanding of the scenarios and risks as compared to purely qualitative studies such as Process Hazard Analyses. LOPA can be used to address a wide range of risk issues and serves as a highly effective aid to decision making.Incorporation of human performance within LOPA is recognized as an important, though often challenging, aspect of the analysis. The human role in potential initiating events or within human independent protection layers is important throughout the process industries, and becomes even more critical for batch processing facilities and in non-routine operations. The human role is key to process safety and the control of risks, necessitating the inclusion and quantification of human actions in independent protection layers for most companies. Human activities as potential initiating events and human performance within independent protection layers are reviewed and methods for quantification outlined. An extension into Human Reliability Analysis (HRA) is provided, including methods to develop Human Error Probabilities specific to the process safety culture and operations at a given plant site.     

Villains,victims, and heroes: Accounting for the roles human activity plays in LOPA scenarios

When a team is analyzing a LOPA scenario, the team needs to consider all three roles played by human interaction in the scenario: that of cause, as a result of human error; that of receptor, both in terms of safety impacts (inside the fence line) and community impacts (outside the fence line); and that of independent layer of protection (IPL), considering both administrative controls and human responses. Frequently, the nature of these three roles are inter-related, and setting guidance that is internally consistent is important to using LOPA to assess risk rather than as a means to game the analyses to simply achieve a wished-for result.A number of criteria have been proposed to quantify human involvement, typically as cause, as receptor, or as IPL. Establishing a framework to look at all three in a unified way is more likely to result in analyses that are consistent from scenario to scenario.This paper describes such a framework and presents it in a way that allows organizations to review their own criteria for quantifying human involvement in LOPA. It also examines some of the published LOPA criteria for human involvement and looks at them in terms of consistency of approach between evaluation of cause, receptor, and IPL. Finally the paper makes suggestions to use in calibrating LOPA methodologies to achieve consistent and believable results in terms of human interaction within and between scenarios that have worked for other organizations.     

基于模糊保护层的池火灾事故风险分析

为计算引发池火灾事故的风险值,提高事故风险的量化水平,判断现有风险控制措施是否满足风险容忍度的要求,为制定减缓风险措施提供依据,给出了新的池火灾风险评估模型。基于传统的保护层分析模型(LOPA),结合模糊集合理论,引入模糊风险矩阵进行风险评估,构建适用于引发池火灾事故的模糊保护层(fL OPA)风险分析模型。该模型的特点是将模糊逻辑和保护层分析结合,减少了传统保护层分析方法计算过程中的不确定性因素,引入严重度减少指数(SRI)概念,使严重度计算、风险评估更加准确。运用该模型对原油储罐泄漏池火灾事故风险进行分析,给出风险决策方案,判断现有保护措施是否能控制风险在可容忍范围内,实例验证了模型的可行性。     

SIL determination: Recognising and handling high demand mode scenarios

The International Standards for Functional Safety (IEC 61508 and IEC 61511) are well recognised and have been adopted globally in many of the industrialised countries during the past 10 years or so. Conformance with these standards involves determination of the requirements for instrumented risk reduction measures, described in terms of a safety integrity level (SIL). During this period within the process sector, layer of protection analysis (LOPA) has become the most widely used approach for SIL determination. Experience has identified that there is a type of hazardous event scenario that occurs within the process sector that is not well recognised by practitioners, and is therefore not adequately handled by the standard LOPA approach. This is when the particular scenario places a high demand rate on the required safety instrumented function. This paper will describe how to recognise a high demand rate scenario. It will discuss what the standards have to say about high demand rates. It will then demonstrate how to assess this type of situation and provide a case study example to illustrate how to determine the necessary integrity level. It will conclude by explaining why it is important to treat high demand rate situations in this way and the resulting benefit of a lower but sufficient required integrity level.     

Value at Risk Perspective on Layers of Protection Analysis

Layers of protection analysis (LOPA) is an established tool for designing, characterizing, and evaluating risk in the chemical process industry. Value at risk (VaR) is a method first introduced in the financial sector for modeling potential loss in a complex venture. In this paper we demonstrate the application of VaR principles to the LOPA of an ethylene refrigeration compressor. We calculate the changes in risk profile (probability versus loss) associated with adding or removing different safety interlocks around the compressor. The VaR analysis shows that the benefits of a given layer of protection are not necessarily captured by a single average number, since the entire probability–value curve is affected. This type of analysis will aid in the allocation of limited resources to process risk interventions.     

Integration of process control protection layer into a simulation-based HAZOP tool

This paper discusses the framework methodology behind the proposed simulation-based HAZOP tool. Simulation-based approach is one of the many ways to support conventional HAZOP by its automation. Compared to knowledge-based and other approaches, a HAZOP software tool based on deviations simulation is able to examine the investigated process more into detail and so find root causes of hazardous consequences. Another advantage is the ability to identify also potential hazards which did not occur in the past and might be overlooked. The presented framework methodology uses a layer of protection analysis (LOPA) concept of independent protection layers (IPLs) testing. Control system integrated into the raw process design represents the first of various protection layers of the LOPA concept. As a case study, a CSTR chemical production with nonlinear behavior under Proportional-Integral-Derivative (PID) actions as the predominant type of classical feedback control strategy is used. The presented tool identifies hazardous regimes under conditions when control loop introduces hazardous consequences or even acts synergically with existing hazardous events. Risk derived from different consequences is ranked by the risk assessment matrix (RAM) as a part of the conventional quantitative HAZOP study.     

基于风险矢量图的多场景保护层分析方法研究*

为解决多场景保护层分析（LOPA）存在的问题,建立风险矢量导图,将事故场景、独立保护层、修正因子、事故后果发生频率等因素进行系统分析,分别采用最大值法求和法计算后果发生频率,探讨多重初始事件导致事故发生频率的最优计算方法;阐述点火源、暴露因子以及致死概率等修正因子的使用方法并提出改进建议,避免常规LOPA下致死概率过高的问题。以柴油加氢装置原料油缓冲罐液位过高风险点为例,进行多场景LOPA,应用综合计算法得出多重初始事件导致的液位高后果失效频率为3.2E-02。结果表明:风险矢量导图和正确使用修正因子可有效提高LOPA的质量;不同初始事件导致的场景失效频率值相差较大或存在共用保护层的情况适用最大值法,其他情况则可采用求和法;如果多场景同时适用最大值法和求和法,则采用综合计算法;求和法过于保守,最大值法过于乐观,综合计算法更为准确。     

A formulation to optimize the risk reduction process based on LOPA

This paper presents a mixed integer nonlinear programming (MINLP) model to improve the computational use of the layer of protection analysis (LOPA). For a given set of independent protection layers to be implemented in a process, the proposed optimization model is solved to: a) Include costs associated with the different prevention, protection and mitigation devices, and b) Satisfy the risk level typically specified in the LOPA analysis through the occurrence probability. The underline purpose focuses on improving the analysis process and decision making to obtain the optimal solution in the safeguards selection that satisfies the requirements to be considered as IPL’s. The optimization is based on economic and risk tolerance criteria. As a first stage of this proposal, the safety instrumented system (SIS) design is optimized so that the selection of SIS components minimizes the risk and satisfies the safety integrity level (SIL) requirements. A case study is presented to validate the whole proposed approach.     

Using risk tolerance criteria to determine safety integrity levels for safety instrumented functions

Standards and industry guidelines for Safety Instrumented Systems (SISs) describe the use of hazard and risk analysis to determine the risk reduction required, or Safety Integrity Levels (SILs), of Safety Instrumented Functions (SIFs) with reference to hazardous events and risk tolerance criteria for them. However, significant problems are encountered when putting this approach into practice. There is ambiguity in the meaning of the term hazardous event. Notably, even though it is a key concept in the process-sector-specific SIS standard, IEC 61511/ISA 84, it is not defined in the standard. Consequently, risk tolerance criteria for hazardous events are ill-defined and, therefore, they are not the most appropriate criteria to use. Most current approaches to SIL determination use them and therefore they are flawed fundamentally.An informed decision on the tolerability of risk for a facility cannot be made by determining only the tolerability of risk for individual hazardous events. Rather, the tolerability of the cumulative risk from all hazard scenarios and their hazardous events for a facility must be determined. Such facility risk tolerance criteria are the type used by regulators. This issue applies to all per event risk tolerance criteria. Furthermore, determining the tolerability of risk for a facility based only on the risks of single events, be they hazard scenarios or hazardous events, and comparing them to risk tolerance criteria for the events is not meaningful because there is no consideration of how many such events can actually occur and, therefore, no measure of the total risk. The risks from events should be summed for a facility and compared with overall facility risk tolerance criteria.This paper describes and illustrates SIL determination using a risk model implemented within the framework of Layers of Protection Analysis (LOPA) that overcomes these problems. The approach allows the allocation of risk across companies, facilities, processes, process units, process modes, etc. to be managed easily.     

Mechanism analysis and risk assessment of escalation scenario in chemical industry zones

Many major hazard installations (MHIs) are located in chemical industry zones and escalation effect may be triggered when the fire or explosion occurs on a MHI. To investigate the mechanism of the accident escalation, a systematic quantitative assessment methodology is proposed by the considering the feature and uncertainty of the escalation scenario. The main accident energy carriers of the escalation are heat radiation, overpressure of blast and fragments. The escalation probability, joint influence of the three energy carriers and risk characterization of the accident scenarios are carried out. By the new methodology, the escalation scenario in chemical industry zones can be analyzed and the risk escalation morphology is demonstrated by the simulation software. The visualized risk cloud figure gives a supplementary way to prevent the escalation scenario in chemical industry zones planning.     

保护层分析中独立保护层的识别研究

为阐述保护层分析(LOPA)中独立保护层(IPL)的识别规则,以及这些规则在实际应用中要注意的问题,以生产聚氯乙烯(PVC)的间歇聚合反应为例,对8个不同的LOPA场景进行分析,给出不同场景的IPL和要求时的失效概率(PFD),以及建议增加的IPL。分析结果表明,在进行IPL的识别时,应重点确认IPL的有效性和独立性。在评估IPL有效性时,应关注具有共同元件的IPL,IPL的行动能力、人员行动有效性及IPL的PFD等。在评估独立性时,应确保IPL独立于初始事件和同一场景中的其他IPL的任何构成元件。通过分析,发现PVC工艺中安全阀(PSV)设计、安全仪表功能(SIF)设计和人员行动等IPL中存在的问题,并提出相应的建议。     

基于LOPA逻辑的罐区多米诺效应定量风险评估*

为了更好地降低化工企业罐区事故造成多米诺效应的风险,提出1种基于保护层分析（LOPA）的定量风险评估程序。首先,阐述基于保护层分析(LOPA)逻辑的多米诺定量风险评估流程,即引入包括可用性、有效性及3种逻辑门定义及量化的安全屏障定量评估;然后,利用LOPA的分析逻辑将安全屏障融入多米诺定量风险评估框架中;最后,选取2×2 000 m3苯乙烯罐区为对象,识别防火层与喷淋冷却系统2种安全屏障并开展基于LOPA逻辑的罐区多米诺效应定量风险评估,得出安全屏障能有效地降低多米诺事故发生频率及罐区个人风险的结论。研究结果表明:该分析方法可为化工企业开展多米诺效应定量风险评估提供参考。     

HAZOP-LOPA方法与SIL定级在电镀废水处理中的应用

为了保证电镀废水处理工艺的安全性,首先采用危险与可操作性分析(HAZOP)方法定性辨识工艺中潜在的危险和危害,并提出安全对策措施;然后采用保护层分析(LOPA)方法定量计算现有保护措施是否能够将风险控制在可接受范围;如果风险较高,通过增加安全仪表等级(SIL)降低风险值。并通过实例分析证明HAZOP-LOPA分析方法能够有效地实现电镀废水处理工艺的风险评价。     

HAZOP、LOPA和SIL方法的应用分析

通过概括介绍危险与可操作性分析(HAZOP)、保护层分析(LOPA)和安全完整性等级分析(SIL)三种方法的特点,总结三种分析方法之间的关系.LOPA分析是HAZOP分析的继续,可以解决HAZOP分析中残余风险不能定量化的不足,是对HAZOP分析结果的丰富和补充;SIL分析则在LOPA分析的基础上,进一步对需要增加的安全仪表系统(SIS)进行设计,并对LOPA分析结果进行验证,即HAZOP、LOPA分析是SIL分析的前期准备工作.因此,在详细介绍SIS的组成、安全生命周期阶段、SIL的选择确定方法以及SIL分析流程之前,也简要介绍了HAZOP、LOPA分析方法,梳理了两种方法的分析流程.最后通过引入示例来展示三种分析方法之间的关系.     

Beyond-compliance uses of HAZOP/LOPA studies

Recent years have seen a convergence of scenario-based Hazard and Operability (HAZOP) studies, Layer of Protection Analyses (LOPAs), and safety integrity level (SIL) determinations. These can all be performed using order-of-magnitude estimates for the initiating cause frequency, the effectiveness of protection layers, the severity of loss event consequences, and the inclusion of other risk-reduction factors. Conducting a HAZOP study or a HAZOP/LOPA study in this manner makes it possible to extend the study results to not only determine required SILs, but also to sum scenario risks by process unit and show the quantitative benefit of implementing risk-reduction measures. The aggregated risk can be compared to process-wide tolerable risk criteria, in addition to comparing each scenario to a risk matrix or risk magnitude. This presentation demonstrates how a true risk-based HAZOP study can be performed with little additional effort over that required for commonly performed cause-by-cause HAZOP studies, and how facility managers and engineers can then use the results when deciding on and implementing risk-reduction measures.     

Design support for the systematic integration of risk reduction into early chemical process design

Design for safety in the chemical industry is becoming a more explicit and well-organised process. However, it requires additional support tools to enable designers to pay attention to safety from the earliest conceptual design stage and through the subsequent detailing and to design more cost-effectively. This paper presents a more explicit approach called design for safety (DfS), which links with approaches already in use, such as layers of protection approach (LOPA). The method consists of two elements, a technology management environment (TME) aimed at supporting the interaction between the many contributors to safe design and a safety modelling language (SML). This provides a rigorous object-oriented language for conceptualising the requirements for risk control (barriers) and analysing their vulnerability to degradation or attack by other system elements or conditions. The method provides a focus for organising and applying existing knowledge about risk control and systematically learning from new knowledge to be gathered and supplied in supporting databases.