Layer of protection analysis (LOPA) for determination of safety integrity level (SIL) stud. techn. Christopher A. Lassen

Transcription

1 Layer of protection analysis (LOPA) for determination of safety integrity level (SIL) stud. techn. Christopher A. Lassen The Norwegian University of Science and Technology Department of Production and Quality Engineering June 2008

2 Preface This report is the result of the master project executed Spring 2008, and is the final step in graduating as an Engineer with a Msc degree from The Norwegian University of Science and Technology (NTNU). The master project is in collaboration with Aker Subsea AS, which is part of the Subsea Business Area within Aker Solutions. Aker Subsea provides leading oil production systems and equipment located sub-surface, and recent projects are Morvin (North Sea), Kristin (Noth-Sea), Reliance KG-D6 (India) and Dalia (Angola). The work has been performed partly in Trondheim at the facilities of the Department of Production and Quality Engineering (IPK), and at Aker Solutions head quarters outside of Oslo. A very special thanks to my supervisor and professor Marvin Rausand (NTNU) who has been helpful with thorough guidance throughout the master project. Another person that deserves attention is Linn Nordhagen (Aker Engineering and Technology) who has provided helpful information on LOPA from a practical perspective, and given comments to the final product. Gratitude must be expressed toward Aker Subsea and Thor Kjetil Hallan for offering office space, and providing information. Others that should be mentioned are: Katrine Harsem Lund (Scandpower risk management. AS), Bjørn Solheim (BP) and Hanne Rolén (Aker Subsea). Particular gratitude must be expressed to my father, Petter O. Lassen, for advice and support throughout my entire education. Christopher A. Lassen Snarøya, I

3 Contents List of Tables List of Figures IV V 1 Introduction Introduction to LOPA Objectives Limitations and structure Relation to IEC and Methods in determining SIL Quantitative method as described in IEC Risk matrix Safety layer matrix The OLF 070 guideline Risk graph Calibrated risk graph LOPA What is LOPA? Explanation of terms The LOPA team LOPA worksheet and the LOPA process Different approaches in literature Aker E&T methodology Preferred approach Flowchart Comments to the preferred LOPA approach Interface with HAZOP Introduction to HAZOP HAZOP integration Adjustments and transformation of data HAZOP / LOPA program specification II

4 5.5 Illustration of software program Case study: Applicability of LOPA Case text Introduction to system LOPA applied on the case study Comments to the result Implications during the case Conclusions and recommendations for further work 60 A Basic concepts 66 B Software schematic 67 C Case study: Worksheet 73 III

5 List of Tables 1.1 SIL for safety functions operating in low demand of operation adapted from IEC (2003) Risk classification of accidents adapted from IEC Frequency of hazardous event likelihood adopted from IEC SIL requirement table adopted from OLF Classification of risk parameters adopted from IEC Example calibration adapted from IEC Important columns in the LOPA report / worksheet adapted from IEC (2003) Target mitigated event likelihood for safety hazards adapted from Nordhagen (2007) Typical frequency values assigned to initiating causes adapted from CCPS (2001) PFDs for IPLs adapted from CCPS (2001) and BP (2006) Process HAZOP worksheet adopted from Rausand (2005) Initiating cause frequencies IPL PFDs IV

6 List of Figures 1.1 Safety lifecycle (IEC 61508, 2003) Typical risk matrix modified for SIL determination adapted from (Marszal and Scharpf, 2002) Safety layer matrix diagram adapted from IEC (2003) Typical risk graph Risk analysis procedures adopted from Rausand and Høyland (2004) The LOPA onion Relation between initiating causes, impact event, process deviation and IPLs Extract of SIL determination methodology from Ellis and Wharton (2006) Aker E&T methodology adapted from Nordhagen (2007) Preferred approach Relationship between HAZOP and LOPA worksheets SPS and separator schematic Relation between initiating causes, impact event, process deviation and PLs B.1 Step B.2 Step B.3 Step B.4 Step B.5 Step C.1 LOPA worksheet: Case study V

7 Abbreviations AIChE Aker E&T AMV BP BPCS CCF CV DHSV ESD EUC FTA FMECA FPSO HAZID HAZOP HCM HIPPS HPU IEL IPL LOPA MEL MV OREDA PCV PFD P&ID PIG PL PSD PSDV PST American Institute of Chemical Engineers Aker Engineering & Technology annulus master valve British Petroleum basic process control system common cause failures control valve downhole safety valve emergency shutdown equipment under control fault tree analysis failure modes, effects, and criticality analysis floating production, storage and offloading vessel hazard identification study hazard and operability study HIPPS control module high integrity pressure protection system hydraulic pump unit intermediate event likelihood independent protection layer layer of protection analysis mitigated event likelihood master valve (PMV) Offshore Reliability Data production choke valve probability of failure on demand piping and instrumentation diagram pipeline inspection gauge protection layer process shutdown process shutdown valve pressure safety transmitter VI

8 PSV PT QRA ROV SCM SEM SIF SIL SIS SPS TMEL TT VB WV XV XT pressure safety valve pressure transmitter quantitative risk analysis remotely operated vehicle susbea control module electronic control module safety instrumented function safety integrity level safety instrumented system subsea production system target mitigated event likelihood temperature transmitter Visual Basic wing valve (PWV) cross-over valve (XOV) X-mas tree (XMT) VII

9 Summary Layer of protection analysis (LOPA) and other safety integrity level (SIL) determination methods have been described, and the terms used in LOPA have been thoroughly defined and clarified. Different views on LOPA found in literature have been presented, and a preferred / recommended LOPA approach has been developed and described. This preferred approach has also been applied on a case study based on systems from Aker Engineering and Technology and Aker Subsea. The interface between LOPA and hazard and operability study (HAZOP) has been discussed, and it has been presented how an integrated software tool could work. The SIL is a measure of the availability of a protection layer or barrier. Protection layers include basic process control system (BPCS), critical alarms and human intervention, safety instrumented functions (SIF), physical protection and emergency response. All these mitigate the frequency of the occurrence of the potential unwanted end-consequence or mitigate the impact the endconsequence represents. LOPA is a tool to determine the SIL of a SIF and evaluates the other protection layers individually by looking at the risk mitigation they lead to. Other tools are the quantitative method described in IEC 61508, the OLF 070 guideline, risk matrix, safety layer matrix, risk graph and the calibrated risk graph. Except from the quantitative method in IEC and the OLF 070 guideline these are graphical and qualitative methods which are simpler than LOPA. These SIL determination methods do not differentiate between the individual risk mitigation the protection layers lead to. A clear understanding of the terms in LOPA is important, and a clear methodology essential to ensure a strong framework. The following relationship between terms are defined: The initiating causes lead to a process deviation, which again may lead to an impact event that may result in an end-consequence. Protection layers are introduced previously and subsequently to the impact event. An example is the initiating cause slippery road which lead to the impact event car crash. The car crash has an end-consequence of three fatalities. In order to prevent this fatal outcome, protection layers as rigid car body, air-bags, and traction control may serve as protection layers. The preferred LOPA approach developed during the master thesis is based on the one in IEC 61511, taking the views from other methodologies in literature VIII

10 into account. The impact event is the starting point of the analysis. The frequency of the initiating events are multiplied with the probability of failure on demand for all credited independent protection layers. In addition occupancy and ignition probability (if applicable) is multiplied with the result. The final value is denoted the intermediate event likelihood. This is the frequency of the occurrence of the end-consequence with the existing protection layers in place. By comparing this with a target frequency measure, the needed SIL is estimated. HAZOP is a hazard identification method often applied previously or simultaneously to a LOPA. By integrating HAZOP and LOPA a high quality analysis, requiring less resources, may be the result. HAZOP has information in common with LOPA and some information have to be transformed. A software tool used to combine and integrate the two methods is beneficial. Such a tool is advanced, and must incorporate a complex issue like the implementation of expert judgment, which is important in LOPA. The definition of terms and the preferred approach have proved to be beneficial when applying LOPA during the case study. An extensive issue during this process has been which protection layers that are independent, and which that are not. This requires understanding of basic reliability concepts, but also a great amount of process and system understanding. The concept of independent protection layers should be evaluated further, and together with facilitating expert judgment during LOPA and in eventual software tools, these are considered the main challenges. IX

11 Chapter 1 Introduction 1.1 Introduction to LOPA Offshore accidents may result in causalities and economic loss. Determining specific safety requirements of safety systems is an important part in ensuring that accidents are prevented. In the 1990s the standards IEC and IEC emerged, and the need for documenting compliance with these in a consistent manner led to the introduction of the layer of protection analysis (LOPA). In chemical processes several protection layers are used, and in LOPA the number and the strength of these protection layers are analyzed. LOPA can be considered as a simplified form of a quantitative risk assessment. It can be used after a hazard and operability analysis (HAZOP), and before a quantitative risk analysis (QRA). A difference between LOPA and other tools is that LOPA analyzes the different protection layers individually, and the mitigation they lead to. LOPA is especially used to determine the safety integrity level (SIL) of safety instrumented functions in conjunction with IEC 61511, but also as a general risk assessment tool to evaluate if the protection layers in a system are satisfactory. In addition, several other applications as capital improvement planning, incident investigation and management of change can be found. The method is not used to a large extent in Norway, but widely implemented internationally. In gas / oil industry LOPA is more frequently applied on topside equipment than subsea equipment The concept of protection layers was first covered in the book Guidelines for Safe Automation of Chemical Processes published by the Center of Chemical Process Safety (CCPS), a section of the American Institute of Chemical Engineers (AIChE), in These thoughts were developed further by the industry resulting in internal procedures (Dowell, 1998). In 2001 the CCPS published the book Layer of Protection Analysis, Simplified Risk Assessment describing the LOPA method (Gowland, 2006). The method is also described in Part III Annex F of IEC Extensive literature can be found on LOPA, and stepwise approaches are given both in IEC and CCPS (2001). The terms vary among 1

12 different authors, and definitions and interpretations of terms like scenario and independent protection layers (IPL) may be confusing. 1.2 Objectives The objective of the master project is to gain extensive knowledge of various methods to allocate requirements to safety instrumented systems, with focus on layer of protection analysis (LOPA). As a part of this the following aspects shall be covered: Carry out a literature survey and compare and discuss the different approaches to LOPA found in the literature. Give a thorough presentation of a recommended LOPA approach. The approach shall be stepwise with a clear description of each step. Define and clarify all basic concepts of the recommended LOPA approach. Identify and describe interfaces between LOPA and other risk analysis methods (especially HAZOP) Discuss pros and cons related to LOPA - and especially the limitations of LOPA. Define, exemplify, and discuss the independent protection layer (IPL) concept and discuss the applicability of LOPA in cases where the independence is violated. Compare the applicability of LOPA in determining SIL, and compare LOPA with alternative approaches (incl. risk graphs). If possible, this evaluation should be rooted in a practical case study. 1.3 Limitations and structure A bayesian approach is used in this thesis, which is concerned with the degree of belief compared to a classical approach. The master project is executed in a limited time frame, constraining the coverage of the topic. The reader should have basic understanding of reliability concepts. In addition, knowledge of IEC and IEC is an advantage. An introduction to LOPA and the project is given in Chapter 1. In addition, the relation to IEC and is described to give the reader complementary background information. In Chapter 2 different methods in determining SIL are presented, including the quantitative method in IEC 61508, the risk matrix, the safety layer matrix, the OLF 070 guideline, the risk graph and the calibrated risk graph. Chapter 3 describes LOPA where important terms are defined and clarified. Further different approaches to LOPA are compared and 2

13 discussed. A preferred approach is developed, and presented in Chapter 4, including description of each step and the basic concepts that are employed. The interface between HAZOP and LOPA is covered in Chapter 5. In addition the functionality of a software tool integrating LOPA and HAZOP is described. In Chapter 6 the applicability of the preferred LOPA approach suggested in Chapter 4 is evaluated in a case study. Finally, conclusions and recommendations for further work are given in Chapter Relation to IEC and Requirements to safety instrumented systems (SIS) are given in IEC and IEC Rausand and Høyland (2004) describe a SIS as a system comprising sensors, logic solver(s), and actuating (final) items, and can be looked upon as an independent protection shell for machinery or equipment. What the safety systems shall protect is referred to as equipment under control (EUC) and is defined as Equipment, machinery, apparatus, or plant used for manufacturing, process, transport, medical, or other activities (IEC 61508, 2003). A SIS implements the wanted safety function needed to maintain a safe state of the equipment and has the function of achieving the essential risk reduction given by the requirements (IEC 61508, 2003). Subsequently to the SIS-definition a safety instrumented function (SIF) can then be defined as a function implemented by one or more SIS. However, usually a SIS realizes a number of SIFs (IEC 61508, 2003; Schönbeck, 2007). Safety integrity is the probability of the safety related system performing the required safety functions under all conditions, within a period of time. Safety integrity level (SIL) is classified into four levels, and is defined by the probability of failure on demand (PFD). The PFD is the average safety unavailability of an item, thus the mean proportion of time the item does not function as a safety barrier. A protection layer is considered a safety barrier. When evaluating Table 1.1: SIL for safety functions operating in low demand of operation adapted from IEC (2003) Safety integrity Average probability of failure to perform its design level (SIL) function on demand to < to < to < to < 10 1 the SIL-requirements the system has to be classified either as high demand of operation or low demand of operation. For subsea production equipment low demand would be the most applicable because the systems are not used fre- 3

14 quently. The SIL-requirement is then verified by calculating the PFD (Rausand and Høyland, 2004; Schönbeck, 2007). In Table 1.1 the PFD related to the four SILs for low demand of operation is presented. Standards do not require how the SIL should be determined to the SIFs, only that they have to be determined. Figure 1.1 shows the safety lifecycle used as the basic framework in IEC and IEC This framework makes it possible Figure 1.1: Safety lifecycle (IEC 61508, 2003) to deal with requirements and activities in a structured manner. After the two initial phases, "concept" and "overall scope definition", the risk associated with the EUC is analyzed in the "Hazard and risk analysis"- phase. Techniques as checklists, failure modes and effects analysis (FMEA) and HAZOP may be used. The next step, which has a red box in Figure 1.1, is to specify the overall safety requirements in terms of safety functions and safety integrity which are needed to achieve the necessary risk reduction. It is during this activity the SIL is determined, and this activity / phase is of greatest importance. LOPA may be applied 4

15 during this phase, but other methods like risk graph and safety layer matrix are also applicable. In the next phase, "safety requirements allocation", the safety functions are allocated to one or more SIS. Although phase four is the most interesting in this case, phase three and five will come into play, as they give the input and receive the output from phase four. All of these activities are carried out in the design phase prior to final design and manufacturing (Rausand and Høyland, 2004; IEC 61508, 2003; Schönbeck, 2007). 5

16 Chapter 2 Methods in determining SIL As mentioned in the previous section various SIL determination methods and tools exist. These may be applied during phase four in Figure 1.1, and in this chapter the most common are presented briefly. Organizations have developed these tools to help engineers to estimate the process risk and convert it to a required SIL (Marszal and Scharpf, 2002). Both qualitative and quantitative approaches may be applied. In qualitative methods the parameters used as decision basis are subjective and estimated by expert judgment. Quantitative methods describe the risk by calculations, and a numerical target value is compared with the result. Which method to apply rely primarily on whether the necessary risk reduction is specified in a numerical manner or qualitative manner. The scope and extent of the analysis would also be an influencing factor. Even if the assignment method is qualitative the SIL is always quantified by a numerical number (IEC 61508, 2003; Marszal and Scharpf, 2002). The methods described in this chapter include the quantitative method in IEC 61511, the risk matrix, the safety layer matrix, the OLF 070 guideline, the risk graph and the calibrated risk graph. 2.1 Quantitative method as described in IEC The approach starts off with establishing the tolerable risk target, which must be in accordance with the company risk acceptance criteria. This is the acceptable number of times the SIF is allowed to fail, i.e. the tolerable number of times per year the specific unwanted consequence may occur. This can be determined from a table where categories of consequences are assigned acceptable frequencies. Such a classification is shown in Table 2.1. Assigning numerical values in terms of frequencies, defining which classes that are tolerable and plotting the consequence specific to the situation, makes it possible to determine the tolerable risk target. If class III in Table 2.1 is tolerable, a catastrophic consequence has a tolerable risk target of improbable which has an assigned numerical frequency per year (IEC 61508, 2003). 6

17 Table 2.1: Risk classification of accidents adapted from IEC Frequency Consequence Catastrophic Critical Marginal Neglible Frequent I I I II Probable I I II III Occasional I II III III Remote II III III IV Improbable III III IV IV Incredible IV IV IV IV The next step is to determine the EUC-risk. Risk is a measure of probability and consequence. The EUC-risk consists of the unwanted consequence, and the demand rate on the system without protective features, i.e. number of times per year the unwanted consequence occur without the SIF. This can be estimated using quantitative risk assessment methods, e.g. fault tree analysis (FTA) or reliability block diagram (RBD) (IEC 61508, 2003). The final step is to calculate the necessary risk reduction to meet the tolerable risk. This is obtained by dividing the number of times per year the SIF fail by the number of demands per year. The result is the acceptable number of times the SIF may fail per demand per year thus the needed probability of failure per demand, which is the PFD. The SIL requirement could be allocated further down to subsystems, e.g. by expert judgment (IEC 61508, 2003). A separator located topside on a platform or floating production, storage and offloading vessel (FPSO), with a riser down to a subsea production system (SPS) consisting of X-mas tree (XT) and reservoir, could be used as an example. The EUC is in this case defined as the separator. The acceptable frequency of overpressure of the separator could be 10 6 /year, which could answer to category class III with critical consequence. Note that this is the acceptable frequency of a given unwanted consequence, which in this case is overpressure. The consequence could in some cases also be directly related to human harm. From the reservoir the demand rate on the system, without any protection systems, can be found. If this is estimated to be 25 demands/year, the approach gives: Acceptable no. of times the SIF may fail / year PF D No. of demands / year = = This result is the acceptable frequency / demand, hence the probability of failure on demand. The protection system may consist of several sub-systems performing several SIFs, and the PFD may be allocated further down. In this case high integrity pipeline protection system (HIPPS), production shutdown (PSD), emergency shut down (ESD) etc. are such systems or functions. 7

18 2.2 Risk matrix Risk matrix, or often denoted hazard matrix, is one of the most popular SIL determination methods due to it s simplicity. The risk matrix takes frequency and consequence into account qualitatively, based on a categorization of the risk parameters. Figure 2.1 shows a typical risk matrix diagram is modified for SIL determination. The consequence and frequency (likelihood) make one axis each, enabling the user to plot the situation under consideration in the diagram. If each box in the diagram has an attached SIL level, the determination process is simple. The consequence categories may be expressed in terms of economic, human or environmental loss. The categories divide the consequences into minor, serious or extensive according to the level of severity. The likelihood categories are divided into low, moderate or high. The categories can be selected either qualitatively, using expert judgment, but quantitative tools can in some cases be utilized to make it easier to determine which category to use. Then the categories may be attached to economic figures, number of fatalities, frequency categories, etc. In Figure 2.1, different SILs are applied. Minor consequence - low likelihood lead to no SIL required. This means that the risk is considered tolerable. Minor consequence - moderate likelihood lead to a low SIL, while extensive consequence - high likelihood lead to a high SIL. If a SIL 3 is required, further analysis should be done, as one SIF may not provide sufficient risk reduction (Marszal and Scharpf, 2002). Figure 2.1: Typical risk matrix modified for SIL determination adapted from (Marszal and Scharpf, 2002) If the consequence is one that could cause any serious injury or fatality on 8

19 site or off site, it could be categorized as serious. If the frequency of this outcome is expected to be > 10 2, the assigned category is high. This consequence - likelihood pair would in Figure 2.1 give a SIL 3, but with further analysis required (Marszal and Scharpf, 2002). It is important to emphasize that the categorization and determination may lead to an unrealistic result. Other tools and methods may be used in conjunction with this method to improve the quality of the categories and the accuracy of the plotting (Marszal and Scharpf, 2002; IEC 61511, 2003). 2.3 Safety layer matrix Safety layer matrix is a risk matrix which in addition to frequency and consequence takes the number of protection layers (PL) into account. The resemblance between Figure 2.1 showing a typical risk matrix, and Figure 2.2 which show a typical safety layer matrix, is as expected strong. A PL is according to IEC a grouping of equipment and / or administrative controls which functioning together with other protection layers mitigate the process risk. A PL must lead to a risk reduction factor of at least 10, and fulfill the following criteria (IEC 61511, 2003): Specificity (one PL designed to prevent or mitigate the consequences of one potential hazardous event. Multiple causes may initiate action by the PL) Independence (PL must be independent of other protection layers, no common cause failures (CCF)) Dependability (PL must act as intended in design) Audibility (PL must be designed to facilitate validation of function) A SIS is considered a safety instrumented PL (IEC 61511, 2003). Compared to the term safety barrier as presented in Sklet (2006) a PL is a safety barrier with additional requirements. The classification of the consequence severity is almost identical as for the risk matrix, with severity categories minor, serious and extensive. Table 2.2 shows how to estimate the likelihood of the hazardous event which leads to the unwanted consequence or impact. The categorization of likelihood in the risk matrix approach focus on frequency specifically, while the safety layer matrix categorization in IEC is based on type of events. Plant specific data should be employed, if available, to establish the likelihood. The event classification in IEC makes it easy to distinguish between the frequency categories, as the frequencies are related to specific events. Note that the categorization of likelihood and consequence is done without considering the PLs (IEC 61511, 2003). 9

20 Table 2.2: Frequency of hazardous event likelihood adopted from IEC Type of events Likelihood Qualitative ranking Events such as multiple failures of diverse instruments or valves, multiple human errors in a stress Low free environment, or spontaneous failures of process vessels Events such as dual instrument, valve failures, or Medium major releases in loading / unloading areas Events such as process leaks, single instrument, High valve failures or human errors that result in small releases of hazardous materials *The system should be in accordance with this standard when a claim that a control function fail less frequently than 10 1 per year is made Figure 2.2: Safety layer matrix diagram adapted from IEC (2003) 10

21 Figure 2.2 shows a typical safety layer matrix. The risk criteria are embedded into the diagram, and the methodology and categorization is similar to the risk matrix. The specific hazardous event likelihood and hazardous event severity classification is plotted. This results in one of the 9 columns in the figure. In order to determine the the final box in the figure that contain the necessary SIL - the number of PLs must identified (IEC 61511, 2003). An example could be a process leak resulting in catastrophic consequence to personnel (several causalities). The hazardous event severity is categorized as serious. In Table 2.2 the occurrence of a process leak is classified with high likelihood. Two mechanical pressure relief devices were identified satisfying the PL criteria. In Figure 2.2 an event with serious consequence - high likelihood rating with two PLs, would require a SIL 2. If the number of PLs had been one, a SIL 3 and additional analysis would be required. 2.4 The OLF 070 guideline OLF 070 was developed by operators and suppliers of services and equipment, to facilitate the implementation of IEC and IEC in the Norwegian petroleum industry. The guideline presents conservative minimum SIL requirements. A conservative requirement is a strict requirement which takes uncertainty into consideration. It can be compared to oversizing a beam in order to ensure the rigidity of the construction. The requirements in OLF 070 are given in a set of tables in chapter seven of the guideline. Background information, as definition of function including schematics and assumptions, for the various SIL requirements is documented in appendix A OLF 070. If the tables are not applicable, then a risk based methodology should be used. The guideline makes it possible to skip many of the steps in the determination process, leading to reduced engineering costs. But, the approach is not fully risk based and the results are not as appropriate as quantitative calculations (OLF 070, 2004). Table 2.3 show the table with SIL requirement to a subsea ESD function. 2.5 Risk graph The risk graphs are based on methods described in the German publication DIN published in 1994, and is a popular approach for determining SIL (Baybutt, 2007). Risk graphs are qualitative and category based. It considers the consequence and frequency of the hazardous event, but also occupancy and the probability of personnel avoiding the hazard (Marszal and Scharpf, 2002; Baybutt, 2007). In Table 2.4 the classification of the risk parameters suggested in IEC is shown. The consequence parameter (C) describes the likely outcome of the hazardous event, and four categories of consequences are suggested. C A is less severe than C D, ranging from light injury to many fatalities. In this case conse- 11

22 Table 2.3: SIL requirement table adopted from OLF 070 Safety function SIL Functional boundaries for given SIL Ref. requirement / comments Subsea ESD 3 Shut-in of one subsea well A.13 Isolate one subsea well The SIL requirement applies to a conventional system with flowline, riser and riser ESD valve rated for shut-in conditions. Isolation of one well by activating or closing: - ESD node - Topside HPU and / or EPU - WV and CIV including actuators and solenoids - MV - DHSV including actuators and solenoids NOTE: If injection pressure through utility line may exceed design capacity of manifold or flow line, protection against such scenarios must be evaluated specifically NOTE: If a PSD system is specified for a conventional system for safety reasons, the PSD functions shall be minimum SIL 1 12

23 Table 2.4: Classification of risk parameters adopted from IEC Risk parameter Category Classification Consequence (C) C A Light injury to persons C B Serious injury to one or more persons. Death of one person C C Death of several persons C D Catastrophic effect, very many people killed Frequency of presence in the hazardous zone (F) (occupancy) Possibility of avoiding the consequences of the hazardous event (P) Frequency of the unwanted consequence (W) F A F B P A Rare to more frequent exposure in the hazardous zone Frequent to permanent exposure in the hazardous zone Possible under certain conditions P B Almost impossible W 1 A very slight probability that the unwanted occurrences occur and only a few occurrences are likely W 2 A slight probability that the unwanted occurrences occur and few occurrences are likely W 3 A relatively high probability that the unwanted occurrences occur and frequent occurrences are likely 13

24 quences are measured in the extent of injury to people, but also environmental or financial target measures can be utilized (IEC 61511, 2003; Marszal and Scharpf, 2002). The occupancy parameter (F) indicates the fraction of time the hazardous area is occupied by personnel. F B indicates higher risk than F A, as the area is more frequently exposed. Usually, F A is selected if the hazardous area is occupied less than approximately 10% of the time IEC (2003). The possibility of personnel avoiding the hazard is incorporated in the parameter P. This parameter reflects what methods the personnel have to identify and escape the hazard. In addition skill and supervision in process operation, and the rate of development of the hazardous event are taken into account. Two categories, P A and P B, are suggested and P B indicates the highest risk. A checklist of statements that must be true in order to select P A, can be utilized in the evaluation. Such statements are suggested in IEC The final parameter is the demand rate parameter (W), which is the frequency per year of the unwanted consequence without the concerning SIF but with other safeguards operating. Also for this parameter higher parameter indices indicate higher risk, as they take less credit for risk reduction by other safeguards. W 1 indicates that only a few occurrences are likely, and a demand rate less than 0.03 per year could fit such description. W 2 and W 3 indicate that few occurrences or frequent occurrences are likely, and suitable demand rates per year could be and more than 3, respectively. The choice of this parameter will affect the result, and care should be taken when selecting category (Baybutt, 2007; IEC 61511, 2003). Figure 2.3 shows a typical risk graph diagram. The path from left to right is decided by the selected risk parameters. The selected consequence, occupancy and possibility of avoidance categories result in an output row X. Each output row corresponds to three values of W. The selection of the demand rate W is the last step in determining the SIL. Higher W -parameter lead to a higher SIL. The tolerable level of risk is embedded in the boxes in the three columns at the right hand side, and the choice of these must support the company risk criteria (Marszal and Scharpf, 2002; IEC 61511, 2003). If the separator example, as explained in section 2.1, is employed - the reasoning will be as follows: If the likely consequence is evaluated to be serious injury to one or more persons, C B is selected. Then, F A is chosen because the area could be rare to more frequent exposed to personnel. It is possible under certain conditions to avoid the consequences, which indicates that parameter P A should be used. The combination of these risk parameters result in output row X 2. It is a relative high probability that the unwanted occurrence takes place and the demand rate category is set to W 3. In Figure 2.3 this results in a SIL 1 requirement. 14

25 Figure 2.3: Typical risk graph 2.6 Calibrated risk graph The calibrated risk graph method is a semi-qualitative method, similar to the qualitative risk graph. The same risk parameters are used as for the conventional risk graph approach, and Figure 2.3 is also applicable. Calibration means that numerical values are assigned to the risk graph, and these are assigned to the risk parameters. This allows a more precise determination of the SIL, and making the decisions more objective. The calibration depends on individual and societal risk, and these issues in addition to company criteria and authority regulations, should be considered before assigning the parameter values. Calibration does not need to be carried out every time a SIL need to be determined. The organization only need to do it once for similar hazards(iec 61511, 2003). The consequence can be quantified by the number of fatalities. But in many instances a failure does not cause immediate fatality, which leads to the introduction of the vulnerability concept. Vulnerability (V) is a function of the concentration of the hazard and the duration of the exposure. In Table 2.5 a vulnerability range is given. By multiplying this measure with the number of people present when the area exposed to hazard is occupied, the number of fatalities is estimated. In the table a range is assigned to each consequence category, making the categorization possible. Note that vulnerability (V) and possibility of avoiding the hazard (P) are two different factors. V concerns the escalation, while P concerns the prevention of the hazard by the operator (IEC 61511, 2003). 15

26 Table 2.5: Example calibration adapted from IEC Risk parameter Classification Consequence (C) C A Minor injury Number of fatalities Can be calculated as: No. of people present when the area exposed to the hazard is occupied vulnerability to the identified hazard C B 0.01 < No. of fatalities < 0.1 V = 0.01 (small release of flammable toxic material) C C 0.1 < No. of fatalities < 1.0 V = 0.1 (large release of flammable or toxic material) V = 0.5 (As above but also a high probability C D No. of fatalities > 1.0 of catching a fire or highly toxic material) V = 1 (Rupture or explosion) Occupancy (F) F A Occupancy < 0.1 F B Percentage of time the exposed area is occupied during a normal working period Possibility of avoidance (P) P A Hazard can be prevented by operator taking action, after he realizes SIS has failed to operate. Refer certain conditions (given in IEC ) P B Adopted if conditions do not apply Demand rate (W) W 1 Demand rate < 0.1D per year W 2 0.1D < Demand rate < 10D W 3 For Demand rate> 10D, higher safety integrity shall be needed D is the calibration factor 16

27 According to Marszal and Scharpf (2002) potential loss of life (PLL) ranges could also be used as a measure of the consequence. PLL is the expected number of fatalities within a population during a specified period of time (NORSOK Z-013, 2001). Note that care should be taken if PLL is chosen as a measure, because it incorporates both probability and consequence. When assigning the other risk parameters it is important to make sure that the consequence parameter is considered independent (Marszal and Scharpf, 2002). The parameter F is often measured by the percentage of time the area, that is exposed to hazard, is occupied. F A should be used if the parameter value is less than 0.1 (IEC 61511, 2003; Marszal and Scharpf, 2002). The avoidance factor P A is selected if all conditions stated in IEC are satisfied. P B is selected if not (IEC 61511, 2003). The demand rate (W) is the number of times per year that the hazardous event would occur in the absence of the SIF under consideration. In Table 2.5 ranges to the different categories are assigned. D is a calibration factor that should make the risk graph result in a level of residual risk that is tolerable. It is important that issues not are accounted for several times, making the result erroneous. Documentation of the calibration process with references is necessary, and should be done with care (Marszal and Scharpf, 2002; IEC 61511, 2003). When the calibration process is finished, and the parameters decided. The risk graph is used to determine the SIL. The demand rate, occupancy and possibility of avoiding the consequence of the hazardous event, represents the frequency of the unwanted consequence. In combination with the unwanted consequence the frequency constitutes the risk without the SIF in place. The input in each box in the risk graph must be in accordance with the tolerable risk (IEC 61511, 2003; Marszal and Scharpf, 2002). The separator example as referred to in the previous section could again serve as an illustration. In this case the vulnerability measure is estimated to be equal to 0.5. Overpressure is severe and results in large release of flammable material with a high probability of catching a fire. If the number of people present when the area is occupied is 2, the resulting number of fatalities is 1 and class C C is selected as the consequence severity. One operator does maintenance work or supervision approximately 45 minutes per day, leading to that the exposed area is occupied less than 10% of the time giving the occupancy class F A. The conditions regarding the possibility of avoidance are satisfied and P A is selected. The calibration factor D is set to 4. The demand rate is estimted to 20 demands per year. This is less than 40 and greater than 0.4 which corresponds to W 2. The SIL is determined as for the qualitative risk graph, and results in a SIL 2 requirement. 17

28 Chapter 3 LOPA 3.1 What is LOPA? LOPA was introduced in the 1990s, and has recently gained international popularity. LOPA is referred to in literature as both a simplified risk assessment technique and a risk analysis tool. Capital improvement planning, incident investigation, and management of change can be found as additional applications. LOPA is a flexible tool which can be used in different contexts and applications making it confusing to understand what it really is. The application under consideration is LOPA as a SIL determination tool. Figure 3.1: Risk analysis procedures adopted from Rausand and Høyland (2004) 18

29 According to Marszal and Scharpf (2002) LOPA can be viewed as a special type of event tree analysis (ETA), which has the purpose of determining the frequency of an unwanted consequence, that can be prevented by a set of protection layers. The approach evaluates a worst-case scenario, where all the protection layers must fail in order for the consequence to occur. The frequency of the unwanted consequence is calculated by multiplying the PFDs of the protection layers with the demand on the protection system (represented as a frequency). Comparing the resulting frequency of the unwanted consequence with a tolerable risk frequency, identifies the necessary risk reduction and an appropriate SIL can be selected (Marszal and Scharpf, 2002; CCPS, 2001). LOPA is a semi-quantitative method using numerical categories to estimate the parameters needed to calculate the necessary risk reduction which corresponds to the acceptance criteria (CCPS, 2001). In a quantitative risk assessment (QRA) mathematical models and simulations are often used to estimate the extent or escalation of damage, e.g. toxic diffusion, explosion expansion or fire escalation. In addition, FTA or other methods are used to calculate the frequency of the accidental event (Rausand and Høyland, 2004). In LOPA, simplifications, expert judgment and tables are used to estimate the needed numbers (CCPS, 2001). LOPA usually receives output from a HAZOP or a hazard identification study (HAZID) and often serve as input to a more thorough analysis as a QRA. Figure 3.1 is often referred to as the bow-tie and is a common figure to describe risk analysis. It shows the accidental event which is linked to the causes and the consequences, and the methods which may be applied in the different phases. An ETA focuses on the consequence spectrum not on the causal analysis, implying that LOPA is placed in column (c) to the right in the figure. On the other hand LOPA is not as in-depth as would be expected from a consequence analysis and does have a close interaction with HAZOP suggesting that it should be positioned more to the middle (column b). The final position is somewhere in between. Often, an "onion" as the one in Figure 3.2 is used as an illustration of the protection layers in LOPA. The system or process design has protection layers including basic process control system (BPCS), critical alarms and human intervention, SIFs, physical protection and emergency response. BPCS is the control system used during normal operation and sometimes denoted as the process control system (PCS). Input signals from the process and / or from the operator are generated into output which make the process operate in a desired manner. If the control system discovers that the process is out of control (e.g. high pressure) it may initiate actions to stabilize the temperature (e.g. choking the flow) (CCPS, 2001; IEC 61511, 2003). Alarms monitoring certain parameters (e.g. pressure and temperature) are considered another protection layer. When the alarm is tripped, the operator may intervene to stop the hazardous development. Note that the alarm system has to be wired to another loop than the BPCS in order to be independent (CCPS, 2001; IEC 61511, 2003). 19

30 Figure 3.2: The LOPA onion 20

31 Rausand (2004) describes a SIS as a system comprising sensors, logic solver(s), and actuating (final) items, and can be looked upon as an independent protection shell for machinery or equipment. A SIS implements the wanted safety function SIF. In LOPA, SIFs are considered as protection layers. Physical protection include equipment like pressure relief devices. In a separator this may be a rupture disc which blows-off pressure if the pressure is too high. Post release protection is physical protection as dikes, blast walls etc. These have their function after the release or explosion has occurred. Both of these types of physical protection are considered protection layers in LOPA (CCPS, 2001; The Dow chemical company, 2002; ACM Facility Safety, 2006). If an accident occurs, procedures, evacuation plans, equipment and medical treatment help the exposed personnel to escape, or to mitigate damage / injury. Such measures are classified as plant and community emergency response, and are considered the final protection layer (CCPS, 2001; The Dow chemical company, 2002; ACM Facility Safety, 2006). LOPA incorporates the reliability of the existing barriers to determine the reliability of the needed SIF. Note that LOPA does not determine what protection layers to implement, only the needed performance. In some cases, a SIF is already present, and the SIL of an additional SIF shall be determined. How many and which protection layers that are required, depend on the situation at hand (CCPS, 2001; The Dow chemical company, 2002). 21

32 3.2 Explanation of terms Various authors use different terms in LOPA. Examples are terms like scenario, impact event and initiating event. This makes it confusing to understand what is meant by the different terms and how they are applied. What exactly is an impact event? Does an impact event description include both causes and consequences? What is an impact event compared to an accidental event? What is a scenario? What is an independent protection layer? Where do we start the LOPA analysis? The objective of this section is to clarify these questions, and build the foundation for the further evaluation of LOPA. The relation between the terms is described by Figure 3.3. Process deviation According to NORSOK Z-013 (2001) an accidental event is defined as event or chain of events that may cause loss of life, or damage to health, the environment or assets. Another definition is the first significant deviation from a normal situation that may lead to unwanted consequences (Rausand and Høyland, 2004). In IEC (1995) they use the term hazardous event instead of accidental event. In the HAZOP study the accidental event is referred to as a process deviation. The term process deviation is from now on used and the definition from Rausand and Høyland (2004) is acknowledged as adequate. Impact event CCPS (2001) describe an impact as: The ultimate potential result of a hazardous event. Impact may be expressed in numbers of injuries or fatalities, environmental or property damage, or business interruption. According to IEC an impact event is equivalent to the consequence in the HAZOP study. This implies that the impact event is the unwanted consequence of the hazardous event or accidental event which is referred to as a process deviation. Impact event is closely related to the unwanted consequence, and the question which remains is what degree of consequence an impact event represents, e.g. end-consequence or intermediate consequence. From now on it is chosen to define impact event as the first sign of harm to people, environment or assets. Examples are a car crash or an explosion due to overpressure of a separator. The impact event may lead to an end-consequence which may include fatalities / injury, environmental damage or economic loss. For the impact event: car crash, the process deviation could be: car starts to slide. The car is out of control and if not the situation is brought back in control, the impact event occurs. For the impact event: explosion due to overpressure of separator, the process deviation could be high pressure up-stream separator. 22