Integrating Risk into your Pant Lifecyce A next generation software architecture for risk based operations Dr Nic Cavanagh 1, Dr Jeremy Linn 2 and Coin Hickey 3 1 Head of Safeti Product Management, DNV Software, London, UK 2 Regiona Manager, DNV Software, London, UK 3 Safeti Product Management, DNV Software, London, UK Over the ast three decades, technoogy for assessing the risks associated with operating major accident hazard faciities has been continuousy deveoped. Over this period the accuracy and speed of the modeing on which this technoogy is based has improved enormousy. The toos for modeing the effects of hazardous reeases in terms of emergency response, safety management and Quantitative Risk Anaysis (QRA), for exampe, are now we vaidated and used extensivey by industry. Aso, the processing power necessary for using these toos is now routiney avaiabe on a typica desktop computer. Other quantitative toos are beginning to appear which use reated technoogy to assist in improving operationa performance, particuary for inspection and maintenance panning activities. These toos are aso progressivey integrating more directy with operationa management systems ike SAP, ERP and ERM. Commercia anaysis toos ike Phast, FRED, Trace and Canary for effects modeing, Safeti, Shepherd and RiskCurves for QRA and Orbit and RBMI for RBI are becoming more and more widey used. These toos are generay used standaone and independenty of one another and other design and operationa systems, even though they share much common data with the atter. Appying risk technoogy more directy into the pant ife-cyce through integration with design and operationa management systems has not kept pace with improvements in other areas. As deveopers of Phast, Safeti and Orbit, we are committed to our technoogy being used throughout the pant ife-cyce and that it is as cosey integrated with our customers vaue chain as possibe. This paper describes our vision for a next generation architecture supporting this integration, the deveopment of which is ongoing. A prototype of this architecture, The Safeti TM Risk Framework, wi be presented aong with a onger term vision for a fuy integrated risk based operations system inking risk technoogy with mainstream design appications and operationa management systems through appication of other risk management techniques CURRENT SITUATION The maturity of risk management in the process industry has seen much advancement in the areas of hazard anaysis, risk anaysis and risk assessment. Goba recognition of the need for professiona risk management has driven the creation of demanding egisative requirements and successfu commercia products and services. This has occurred in
parae with greater need for transparency to the pubic, increased scrutiny of process pant activities and greater demand for better business performance. The wide range of advanced toos and methodoogies used in risk management have been enhanced greaty by the IT revoution. Advanced consequence modeing toos ike Phast continue to be deveoped to meet the evoving and more stringent needs of hazard and risk anaysis in the process industries. The process industry has in parae started to take advantage of advanced products and services for other areas of business management. Advanced systems are used for process contro, asset management, management systems and financia management. COMMONALITY Process faciities have a range of attributes which are drawn upon, measured and controed as part of the business vaue chain. Attributes such as peope, materias, pant, buidings, transport, utiities, governing egisation, processes, weather conditions and market economics are a part of the dynamic environment process pant operators conduct business within. Speciaist toos have been deveoped to support business optimisation through measuring, monitoring and/or controing each of these attributes. For this reason many toos and services used across a process pant and within process industry organisations hande and use the same information. (Cavanagh and Linn 2005) Worthington and Cavanagh 2003, introduced the concept of a data asset as iustrated in Figure 1. Data is contributed throughout the ifecyce of a pant from many sources. Pant design and CAD appications contribute during the design phase, process simuation during design and operationa phases, GIS and safety management toos during design and operation, and so on. These data sources add vaue in reation to how we they can be kept up-to-date, shared and re-used. The Risk Framework provides a means of accessing, maintaining and sharing this data asset. One exampe of a system which uses the atest technoogy and methodoogies to measure and manage attributes of a processing faciity is a fuy integrated process contro system. Such systems are used to measure the state of equipment and materias throughout the site. The contro system tracks process conditions and, with operator contro, makes adjustments to keep process conditions within predetermined imits. This approach ensures design conditions are met and sustained, process efficiency is optimised and aso that non-design and potentiay hazardous conditions do not arise. In addition to process contro, contro systems often contain hazard detection devices such as hazardous gas and fire detectors. These devices feed back to decision ogic in the contro system enabing hazard mitigating response to be carried out. The continuous ive feed of data surrounding process pant conditions are common with the generic data used in hazard and risk anaysis. Yet in contrast to ive contro system contro and response, a risk management study is off-ine and merey a snapshot of design or identified potentia non-design conditions. A second exampe of a system which uses the atest technoogy and methodoogies to measure and manage attributes of a processing faciity is an enterprise wide asset 2
Figure 1. The data asset concept management database too. Such systems are used to store and track the wide range of data associated with pant equipment. Modern extensions of these toos provide support for maintenance and inspection management. Risk anaysis is aready incorporated into asset management toos enabing risks to be quantified for Risk Based Inspection (RBI) using software such as Orbit. RISK AS A DECISION MAKING TOOL Today risk anayses tend to be performed as an offine activity by risk speciaists either to meet the needs of egisative requirements or as part of a pant modification to reduce risk. These tend to be snapshot studies that are fied once the reevant decision has been made or egisative requirement satisfied. In recent years techniques have been deveoped to extend the appicabiity of risk technoogy beyond basic assessment of the severity of an incident or its ikeihood of being reaised. Techniques ike the bow-tie approach and Layer Of Protection Anaysis (LOPA) take account of the barriers and mitigators put in pace to prevent an incident from occurring or escaating or to mitigate its effects if it does occur. A these reated activities can be monitored and high risk operations avoided or extra safeguards put in pace. Used effectivey in operationa decision making these techniques can reduce operationa risk and the ikeihood of an incident that may resut in a oss of ife or to the 3
profitabiity of a pant. So caed Risk Based Operations or RBO enabes decisions to be made based on knowedge and understanding of risks attributabe to certain operations or processes, both before and after any operationa changes are impemented. As has been mentioned earier QRA tends to provide a snapshot of the risks associated with a pant under a particuar set of conditions. If extended to cover a mutitude of scenarios or to take account of changing operationa conditions, these quantifications of risk can, when combined with operationa risk management techniques, provide a rea time measure of the risk to which a pant is exposed. These kinds of systems are abe to provide operationa managers with quantitative rea-time data, rather than static assessments, to support their decision making in an ongoing basis. This kind of risk-based decision support offers increased benefit from risk anaysis, bringing traditiona QRA technoogy and methodoogy into the operationa phase of the pant ife-cyce. By using this information in a more dynamic and hoistic manner, QRA is brought from the back-office into the daiy operationa management of your faciity. THE SAFETI TM RISK FRAMEWORK It is our vision that risk management toos wi be used throughout the ifecyce of the pant from design to operation and beyond. Risk management shoud support engineering design and day to day operation of the pant through ive measures of activities and circumstances and use these to mode the impications on and potentia changes to a business s overa risk exposure. This wi provide instant decision support and accurate perception of rea time risks eading to continuous risk optimisation and reduction. We beieve best risk management practice is now achievabe through the parae evoution of software, data management and internet technoogies aready proven and in use by businesses gobay. The vision for the Safeti TM Risk Framework (Figure 2) is to hep make risk based decision support a reaity at a stages of a pant s ifecyce. By integrating the wide range of existing risk management toos and currenty non risk-based process pant management toos into one compete system, risk becomes a key input to the decision making process. Data of reevance to the risks associated with a process faciity wi feed in and out of a of the existing toos in a fexibe manner. The diagram above iustrates how, for exampe, asset data reevant to a QRA can be reused for an RBI. It aso demonstrates how, for exampe, a Matrix of Permitted Operations (MOPO) as part of a risk assessment system can use information from the asset database and risk measures to feed the contro system or management system for risk based decision support. The Risk Framework concept creates benefits at a number of eves. Reuse of data, ive risk based decision support and integrated business management are some of the many benefits derived from the approach suggested. The foowing scenarios iustrate how the Safeti TM Risk Framework can hep to avoid undesirabe situations arising from typica process pant circumstances. 4
Figure 2. The Safeti TM Risk Framework concept Scenario 1. My pump has a faut and the parae reserve pump is schedued to be down for maintenance which has not started yet. Can I use the reserve pump? This is a commony occurring situation in the process industry. It invoves interaction between a contro system for switching the pump on or off, a permit to work system which is part of the management system and a number of assets; pumps, vaves and pipework. Many approaches have been deveoped to dea with the safe interaction between these business processes. For exampe, eectrica isoation of the pump can be appied to override the contro system preventing it from starting a device when it is in an unsafe state that the contro system cannot measure. In addition, a permit to work system is a document based activity used in management systems to contro and monitor the status of process equipment for carity and safety during manua operation and maintenance. 5
In scenario 1 the foowing are a seection of potentiay undesirabe events arising from faiure of interaction between the controing and monitoring business processes on the site: 1. The paper based permit to work document indicating that the pump was unsuitabe for operation had been ogged incorrecty giving the impression that the pump was fit for service. 2. The contro system is independent of the permit to work system and maintenance scheduing toos. It may detect that the state of the process equipment is norma and aow for remote commands to be sent to the process equipment for start up eading to undesirabe circumstances. Information invoved in this scenario which wi be inked via the Safeti TM Risk Framework: Asset database Equipment design conditions Live process conditions, suppied from contro system devices Maintenance Schedue Live status of risk picture on site based on current circumstances Rues and responsibiities within the management system governing maintenance schedue and permit to work The undesirabe outcomes of this scenario coud be avoided by having one hub with access to a interreated risk reevant information. An eectronic permit to work system tied to high risk equipment provides transparency of pant status for safe operation. Aso, the ive inteigent permit to work system, integrated with the contro system provides a software back-up for the hardware eectrica isoation. This creates an extra ayer of protection in cases of management system processes faiure. Utimatey the status of each piece of process equipment coud be found by driing down through detais on an enterprise wide risk dashboard. Scenario 2: Due to increased production and simutaneous construction and engineering projects, more staff are required on my site. Can I temporariy ocate them at this ocation? The spatia ayout of popuation can change the risk picture of a process faciity. Locating temporary buidings, for exampe, can become a critica part of a faciity s risk exposure. This is the type of decision where risk based support can be critica in the safe operation of a site. It is often the case that the offine, periodic reports created to compy with some European countries oca impementation of the EU Seveso Directive or the consequence based US Risk Management Programme (RMP) form the foundation for the overa risk management of a process pant. These reports are therefore usuay offine taking ideaised standard operating conditions or hypothetica non-idea operating conditions.
They are aso usuay out-of-date soon after they have been created due to the dynamic operating environment of modern process pants. A site being managed with mature risk management processes wi undertake what-if studies using toos such as Phast and Safeti. These effectivey predict what new risk or hazard eves may be posed due to required changes to a site. An arbitrary ine is often drawn under activities for which potentia hazards and overa risks are assumed to be toerabe. The overhead of performing risk assessment is often a disincentive to it being carried out. The undesirabe events posed by seecting different siting ocations for temporary staff faciities can be described using firsty individua risk contours overaid on popuation siting options giving a quaitative assessment of risks. In this exampe based on one simpe faiure case individua risk contours are generated in the form iustrated in Figure 3. Figure 3. Individua risk contours of Scenario 2
For this particuar faciity we have two temporary office siting options as iustrated in Figure 4. Both options require temporary accommodation to be sited cose to the source of hazard aso iustrated in Figure 4. But each option wi pose different eves of societa risk. This is traditionay enumerated using F-N curves as iustrated in Figure 5. As can be seen in the societa risk comparison from the F-N curves in Figure 5, option 2 is the preferred ocation in the context of risk. The Safeti TM Risk Framework concept wi hep to make such decision easier by having a necessary input data continuousy inked to the organisation s risk management consoe as iustrated in Figure 6. What-if studies can be performed quicky and thoroughy. In addition to what-if anaysis the same functionaity within the Risk Framework can be used as a continuous monitor of rea time risks, providing a ive risk dashboard for the site. Figure 4. Two temporary office siting options 8
Figure 5. Societa risk comparison of two office ocation options This requires the Risk Framework to be continuousy processing the risk reevant data on the site to cacuate the ive risk picture. The typica measures of risk societa and individua woud be cacuated continuousy as various aspects of site conditions change. With individua and societa (e.g. risk integra) risks continuousy dispayed with dri-down capabiities for easy identification of main contributors in terms of both equipment and personne. Figure 6. The Safeti TM Risk Framework architecture
the safeti tm risk framework architecture DNV Software aready manages an array of word eading risk management software toos. The Risk Framework concept is an evoution of these toos providing, amongst other things, the next generation architecture for these toos. This is the enaber faciitating integration of existing technoogy with new technoogy and 3rd party systems. The resuting risk framework service patform supports fu ifecyce management. This ensures cost effective reuse of an organisation s data asset and deivers rea time risk based decision support for design and operation. At the core of the Risk Framework is the pant s asset database. It is from here that a activities begin. From hazard anaysis through frequency anaysis to contro and management system decision support through the Risk Management Consoe/Dashboard a data pivots on the underying asset database. At this stage the Safeti TM Risk Framework exists in prototype form and wi be the basis for the next generation of the Phast appication which is we underway. A key deveopment is the evoution from a scenario based to an equipment based mode. This faciitates integration of the underying data modes for QRA, RBI and PHA in Safeti, Orbit and Phast respectivey. This is aso the first step in integration with 3rd party appications, CAD and other databases and provides the enaber for integration with other operationa systems. A further deveopment is the abiity to map data from one mode or data source to another using a configuration utiity rather than hard coded into the software. Again, this deveopment has previousy been prototyped and is now we under way. REFERENCES Cavanagh, NJ. and Linn J., Apri 2005, Beyond Compiance The Future Roe of Risk Toos, AIChE Goba Safety Symposium, Annua Conference of Centre for Chemica Process Safety, Atanta, Georgia, USA Worthington, D.R.E. and Cavanagh, N.J., June 2003, The deveopment of software toos for chemica process quantitative risk assessment over two decades, ESREL 2003 Conference, Safety and Reiabiity, Maastricht, The Netherands. 10