Independent Protection Layers Research Articles

Benefits of customizing dust hazard controls to meet your needs

AbstractThe OSHA Combustible Dust National Emphasis Program (NEP), recent studies commissioned by the National Fire Protection Association (NFPA) Research Foundation and U.S. Chemical Safety and Hazard Investigation Board (CSB), as well as emphasis by insurance companies have brought more urgency to combustible dust safety. NFPA standards are being revised for consistency and clarity of standards for combustible dust safety. While that is a significant improvement from conditions of past decades, the situation can be improved even more by implementing risk‐based methods to help develop application‐specific explosion protection. Many facilities that handle combustible particulate solids follow prescriptive requirements of applicable NFPA standards, especially for new installations. Decisions are often driven primarily by meeting codes and standards with minimum capital cost. Legacy installations that do not meet current standards typically claim “grandfather” status as the reason for not implementing the current standard requirement or good engineering practice. The goal of this paper is to present a method of adapting the familiar process safety risk matrix to assess likelihood of a deflagration event rather than the overall the risk of a consequence. This method provides an objective basis to assist staff of a legacy facility to make decisions to prioritize capital improvement projects, to follow current good engineering practice, and to stop relying on “grandfather” status. This paper makes the broad, practical assumption that any deflagration event has serious consequences. The magnitude of those consequences may vary based on facility siting, deflagration area of effect, population of personnel in the affected area, or business criticality of affected equipment and structures. Decisions based solely on the likelihood matrix may inadvertently prioritize a more likely, but less consequential, concern over an event that may put multiple people at risk, or have serious commercial implications. Methods such as Hazard and Operability Study (HAZOP), Failure Modes and Effects Analysis (FMEA), Fault Tree Analysis (FTA) and Layer of Protection Analysis (LOPA) are useful to more comprehensively understand risks. Flexible, outside‐the‐box thinking in applying safeguards, Independent Protection Layers (IPLs), administrative controls, and facility siting may provide a better solution than merely following prescriptive code without making the effort to fully understand the hazard.

Application and challenges of layers of protection analysis (LOPA) in mining processes: Insights into benefits and limitations

AbstractLayers of protection analysis (LOPA) is a semiquantitative technique widely used in process industries for assessing hazardous scenarios and supporting risk‐informed decision making. It provides a balance between the simplicity of qualitative analysis and the detail of quantitative analysis. This paper discusses the authors' experiences with the application of LOPA in the mining and metals (M&M) industry, combined with traditional methods like HAZOP and HAZID, to identify risks. Several of LOPA's limitations became evident, and scenarios involving human factors, natural events, and asset integrity were excluded from analysis. Certain M&M processes, often complex and heavily reliant on manual operations, pose unique challenges to LOPA's effectiveness due to difficulties in isolating independent protection layers: for example, those involving induction furnaces where overheat scenarios can lead to explosive phase transitions upon contact with water and molten metal. Despite these challenges, the advantages of LOPA, such as enhanced understanding of protection layers and fostering effective safety improvements, are significant. The paper anticipates continued use of LOPA within the company, complemented by safety critical task analysis to manage human errors and enhance safety controls in critical situations.

Providing a comprehensive approach to oil well blowout risk assessment.

Drilling is one of the most dangerous activities in the oil and gas process industries. Therefore, a holistic approach was presented to prevent and control risks and reduce the uncertainty of blowouts, kick scenarios, and control layers based on the Fuzzy Bayesian Network (FBN). Four independent protection layers (IPLs) were used to evaluate the blowout outcome, and the failure probabilities of IPL1 and IPL2 were calculated with Fault Tree Analysis (FTA). Then, different events were transferred to the Bayesian Network (BN) in GeNIe software, and updated the probabilities. The Fuzzy Fault Tree (FFT) results reveal that the failure probabilities for IPL1 and IPL2 amount to 8.94×10-4 and 4.97×10-21, respectively. Also, the blowout probability results based on FFT were larger than FBN. According to FBN, the probability of the kick event was equal to 6.60×10-34. Sensitivity analysis showed that X1 (Mud volume/flow change) had the highest degree of importance in the blowout of oil wells. The results of this study can be used in both a preventive and reactive approach. Deductive and inductive reasoning, the dynamic nature and conditional dependencies, and causal relationships between events can make the model more realistic.

Dynamic simulation for process hazard analysis: Affordances and limitations in the application to complex process systems

Improving process safety is a high priority in process and manufacturing industries to address unwanted accidents and process disruptions. Research into the applications of dynamic simulators for hazard analysis has been rapidly growing. However, there is scant discussion in literature regarding the benefits and limitations associated with the utilization of dynamic simulations for process hazard analysis. A fundamental systems conceptualization, underpinned by the P3 model of people, plant and procedures, provides a framework for the characteristics to be considered by subject matter expertise when identifying the affordances and limitations within a dynamic simulation used for process hazard analysis. This subject matter expertise includes people with operations, process engineering, process safety and process simulation experience. All dynamic simulations will have limitations and understanding the affordances and limitations is crucial for the correct use of a model and the interpretation of results. A case study is presented on the application of a systematic approach for interrogating the dynamic simulation from an industrial operator training simulator of an operating residue catalytic cracking complex with the aim of conducting failure mode and effects analysis by identifying the significant consequences and the associated independent protection layers. Issues with respect to how one could automate the analysis rather than use human observation to assess the outcomes are considered and how to present the outcomes to complement existing process hazard analysis techniques are discussed. Future research requirements and developments that may assist in practically and effectively applying the technique in industry are also discussed.

Systematic errors that compromise integrity of safety instrumented systems

AbstractA safety instrumented system (SIS) is an important independent protection layer (IPL) to mitigate risk. Many IPLs, such as a basic process control system (BPCS), can provide only one order of magnitude risk reduction (RRF 10). A SIS however, is capable of providing one, two, or three orders of magnitude risk reduction (RRF 10, 100, or 1000). Correct specification, design, and maintenance of a SIS is critical to ensure that the SIS delivers the assigned risk reduction. Issues with SIS lifecycle management can lead to systematic errors such as underestimating the safety integrity level (SIL) target, overestimating the risk reduction provided by design, and inadequate maintenance, testing, or replacement. This paper discusses a few of these systematic errors and provide guidelines to avoid them.

Application of layers of protection analysis to prevent coronavirus infection

Layers of protection analysis (LOPA) methodology is applied to an encounter with the SARS‐COV‐2 infection as an initiating event, and subsequently, independent protection layers (IPLs) (namely health safeguarding protocols), such as social distancing, ventilation, hand hygiene, face masks, and vaccinations. LOPA is applied considering numerical quantification of the COVID fatality index in order to manage the transmission risk to a tolerable level, namely the fatality risk due to seasonal flu. This measurement tool quantifies the ratio of the annual death rate due to the SARS‐COV‐2 infection to the annual death rate of the common flu, and it is applied to a chemical plant. The lower this quantified value is, the more the COVID‐19 infection death rate approaches that of the common flu. Thus, any improvement in safeguarding protocols should reduce this index. The input data is based on public domain COVID‐19 infection statistical data and websites accessible in the United Kingdom. The COVID‐19 transmission rate is statistically analyzed with random number sampling to simulate the random pattern of the virus' person‐to‐person infection in the community. The success of the COVID‐19 protection protocols is probabilistic and depends on the public's compliance, which is modeled by observational surveys.

SIL‐3, SIL‐2, and unicorns (there is a high probability your SIL 2 and SIL 3 SIFs have no better performance than SIL 1)

AbstractSafety instrumented system (SIS) standards improved the definition of interlocks and introduced requirements for improved management systems to enforce independence from other independent protection layers (IPLs). SIS standards require verification that the performance of each safety instrumented function (SIF) will be met during its lifetime, where the performance criterion is documented as the target safety integrity level (SIL) or risk reduction factor for the SIF. The SIL is in turn tied to specific values of probability of failure on demand (PFD). The current SIS standards and the TR (Technical Reports, from ISA) that explain how to do SIL verification calculations do not include accounting for specific human error probabilities—this is a major deficiency as even the probability of a single human error can be much larger than the target PFD of 0.001 for a SIL 3 and oftentimes a little larger than the PFD of 0.01 for a SIL 2. The SIL verification methods outlined in the standards and technical reports like ANSI/ISA TR84.00.02 facilitate consistency for the component‐only failure rates. As user companies seek to obtain greater risk reduction from their SIS to satisfy their corporate risk criteria, failure to adequately address potential specific human failures can lead to overly optimistic results and a misallocation of resources intended to reduce risk.

Importance-Based Key Basic Event Identification and Evolution Mechanism Investigation of Hydraulic Support Failure to Protect Employee Health.

Background: Although hydraulic support can help enterprises in their production activities, it can also cause fatal accidents. Methods: This study established a composite risk-assessment method for hydraulic support failure in the mining industry. The key basic event of hydraulic support failure was identified based on fault tree analysis and gray relational analysis, and the evolution mechanism of hydraulic support failure was investigated based on chaos theory, a synthetic theory model, and cause-and-effect-layer-of-protection analysis (LOPA). Results: After the basic events of hydraulic support failure are identified based on fault tree analysis, structure importance (SI), probability importance (PI), critical importance (CI), and Fussell–Vesely importance (FVI) can be calculated. In this study, we proposed the Fussell–Vesely–Xu importance (FVXI) to reflect the comprehensive impact of basic event occurrence and nonoccurrence on the occurrence probability of the top event. Gray relational analysis was introduced to determine the integrated importance (II) of basic events and identify the key basic events. According to chaos theory, hydraulic support failure is the result of cross-coupling and infinite amplification of faults in the employee, object, environment, and management subsystems, and the evolutionary process has an obvious butterfly effect and inherent randomness. With the help of the synthetic theory model, we investigated the social and organizational factors that may lead to hydraulic support failure. The key basic event, jack leakage, was analyzed in depth based on cause-and-effect-LOPA, and corresponding independent protection layers (IPLs) were identified to prevent jack leakage. Implications: The implications of these findings with respect to hydraulic support failure can be regarded as the foundation for accident prevention in practice.

A New Semi-Quantitative Process Safety Assessment Method and Its Application for Fluorochemical Industry

Traditional hazard and operability analysis (HAZOP) is one of the most widely applied methods for process safety management in process enterprises. Due to its principles based on the conservative and qualitative judgment, it often leads to too conservative risk identification results for the fluorine chemical industry usually with high-risk processes to keep the continuity of production. Most of improved quantitative and semi-quantitative methods are based on the layer of protection analysis (LOPA) to resolve the over-conservative problem of traditional HAZOP with the database of LOPA. However, the improved model, taking LOPA as the main line and HAZOP only as the provider of scenarios and influencing factors, is limited to the fact that LOPA can only analyze complete and independent protection layers (IPLs). Therefore, in order to realize the quantitative or semi-quantitative analysis of disaster causes and consequences, a new semi-quantitative HAZOP method takes HAZOP as the main line to integrate LOPA, F&EI (fire and explosion index) for quantitatively calculating the reduction factors, probability on failure demand (PFD) of general protection layers (GPLs) and PFD of IPLs. With the case comparison of fluorine chemical industry, it is proved that this new method can effectively improve the problem that traditional HAZOP are too conservative in complex scenarios.

NSTX-U Personnel Safety System: Safety Instrumented System Development and Design

A safety instrumented system design guided by the International Electrotechnical Commission (IEC) standard IEC/ISA 61511 has been developed to ensure personnel protection from direct radiation and magnetic field hazards identified for the National Spherical Torus eXperiment–Upgrade (NSTX-U) fusion experiment at the Princeton Plasma Physics Laboratory. A layer of protection analysis was performed to develop the performance requirements of the system. A design was developed that incorporated three independent protection layers including configuration-managed safeguards (for electrical hazards), a trapped key system, and a dual chain redundant safety instrumented system. Extensive value engineering was undertaken to supplement existing infrastructure to be compliant with current industry standards and best engineering practices. The development and design of the safety instrumented system is presented.

More issues with layer of protection analysis—From the originators

AbstractLayer of protection analysis (LOPA) has now been around for more 25 years and in general use for now 20 years, starting with the initial textbook being officially published in 2001. Two companion books have been published on the topics of Enabling Events and Conditional Modifiers (2013) and on Initiating Events and Independent Protection Layers (2015). Many papers have been published in the past 20 years on LOPA. This paper shares observations and lessons learned from two originators of LOPA and provides further guidance on how to and how Not to use LOPA. The paper provides specific examples of best practices, some of which are not covered well enough in or are omitted from the textbooks on the topic. The originators of LOPA hope you will use this paper as an expansion on the concepts in the first LOPA textbook, and as an addendum to all three textbooks on the topic.

Risk Assessment Method Combining Independent Protection Layers (IPL) of Layer of Protection Analysis (LOPA) and RISKCURVES Software: Case Study of Hydrogen Refueling Stations in Urban Areas

The commercialization of eco-friendly hydrogen vehicles has elicited attempts to expand hydrogen refueling stations in urban areas; however, safety measures to reduce the risk of jet fires have not been established. The RISKCURVES software was used to evaluate the individual and societal risks of hydrogen refueling stations in urban areas, and the F–N (Frequency–Number of fatalities) curve was used to compare whether the safety measures satisfied international standards. From the results of the analysis, it was found that there is a risk of explosion in the expansion of hydrogen refueling stations in urban areas, and safety measures should be considered. To lower the risk of hydrogen refueling stations, this study applied the passive and active independent protection layers (IPLs) of LOPA (Layer of Protection Analysis) and confirmed that these measures significantly reduced societal risk as well as individual risk and met international standards. In particular, such measures could effectively reduce the impact of jet fire in dispensers and tube trailers that had a high risk. Measures employing both IPL types were efficient in meeting international standard criteria; however, passive IPLs were found to have a greater risk reduction effect than active IPLs. The combination of RISKCURVES and LOPA is an appropriate risk assessment method that can reduce work time and mitigate risks through protective measures compared to existing risk assessment methods. This method can be applied to risk assessment and risk mitigation not only for hydrogen facilities, but also for hazardous materials with high fire or explosion risk.

Risk Assessment and Vulnerability Analysis of Liquefied Natural Gas (LNG) Regasification Terminal

Global demand for liquefied natural gas (LNG) is projected to double by 2040, with gas playing a significant role in a less carbon-intensive power system, to 700 million tons. The risk assessment and vulnerability analysis of liquefied natural gas regasification plant have predominant importance due to increase in demand. Determination of safety integrity level (SIL) for process industries becomes a contemporary relevant factor. The reliability of various equipment used in process plants is critically important to maintain safety standards; malfunctions of these instruments may result in accidents which will affect property, environment and people. The main aim of the work is the risk assessment of liquefied natural gas to identify and rank failures that could result in the release of liquefied natural gas to the surrounding environment. In this paper, we integrate fuzzy risk matrix and layer of protection analysis (LOPA) to find safety integrity level value of each Independent Protection Layer (IPL) of seven scenarios of the liquefied natural gas storage facility. Seven scenarios were identified using hazard and operability analysis (HAZOP) as a process hazard analysis (PHA) tool, and we compare the safety integrity level value with Field Device Tool (FDT) method and risk graph is used to find the risk reduction factor (RRF). The safety integrity level determination using fuzzy methods gives more accurate result when compared with the risk graph methods and also describes the safety issues and hazard characteristics in liquefied natural gas terminal and consequence analysis if a liquefied natural gas tanker at the terminal releases liquefied natural gas due to natural and external man-made events, like recent issues between Saudi and Iran regarding oil transporting through Arabian Gulf, and accidents due to projectile effects. Process Hazard Analysis Software Tool (PHAST) and ALOHA software enable to analyse consequence having exorbitant complexity all while considering weather conditions, usage of land and population in the locality. In this paper, atmospheric dispersion modelling and evaluation of flammable and toxic effects have been done by Process Hazard Analysis Software Tool 8.11. Relationship between SIL, PFDavg and RRF is analysed. The frequency, severity and risk values are also gathered. Fuzzy risk values and SIL for each IPL from fuzzy LOPA are obtained, and furthermore, risk reduction SIL values, FDT method to calculate SIL and release scenario are investigated. Comparing the SIL values from fuzzy LOPA approach and FDT method, the consequence analysis of LNG spills from carrier ship due to natural cause using PHAST 8.11 and LNG leak from carrier ship due to man-made cause using ALOHA is also investigated.

Applying LOPA and fuzzy logic to identify SIL requirement for safety critical functions in a direct reduction iron industry

LOPA11All acronym meanings can be found in the nomenclature table at the end of the article. (Layer of Protection Analysis), is a semi-quantitative hazard analysis technique that can be used after a Qualitative Hazard Analysis Techniques such as HAZOP (Hazard and Operability Analysis) technique, and before a QRA (Quantitative Risk Analysis). LOPA can be used to identify the rate of the SIL (Safety Integrity Level), which specifies the level of safety protection and consequently identifies if the safety system is reliable or requires extra protection layers.LOPA has been used in many industrial processes such as LNG (Liquefied Natural Gas), petroleum and petrochemical industries. This study aims at performing the HAZOP technique on a specific node of a DRI (Direct Reduction Iron) industry, followed by LOPA to have quantified results and to determine whether the available independent protection layers (IPLs) in the system are sufficient. Moreover, it identifies the outcome required by the SIL target. Finally, fuzzy logic method for risk assessment is used as an efficient way to estimate the severity and determine the SIL rate to be compared with the one obtained by LOPA study.

Crediting check valves as IPLs? Testing protocol to better understand check valve reliability

AbstractConventional process safety wisdom assumes that check valves are not reliable safeguards. Experience indicates that check valves are prone to failure and that they may fail undetected. Therefore, the conservative assumption is that check valves may be listed in process hazard analyses as safeguards, but they are rarely considered to meet the standards required of an independent protection layer (IPL). Independent protection layers must be effective, independent, and auditable. Although independence is readily achievable by check valves, confirming and routinely auditing effectiveness is rarely pursued. And maintenance practices for check valves are often insufficient. Little data is available from operating companies regarding failure and leakage rates for different check valve types in various service applications or at various stages of service life. This paper examines a testing protocol that was put in place in 2014 for the purpose of testing check valves in order to apply layer of protection analysis (LOPA) credit to these valves for reverse flow scenarios. In order to understand check valve performance expectations, leakage allowances for new check valves are reviewed. Industry guidance and standards regarding consideration of check valves as safeguards or IPLs are also discussed. The analysis of new valve standards and the assessment of process safety requirements are the basis for establishing the pass/fail thresholds for the tests. The goal of sharing this information is that the discussion will stimulate others to consider the opportunity and the need to set‐up similar testing and to begin gathering and sharing a larger body of data on check valve performance in various applications. Accumulation of check valve performance data and sharing of that data should lead to better understanding of check valve performance by type, size, age, and service. Better performance may be achieved where maintenance is improved and where learnings are applied to selection and design. In instances where requirements are met and credit is due, check valves may be credited in PHA and LOPA.1

Safety Assessment of Casting Workshop by Cloud Model and Cause and Effect-LOPA to Protect Employee Health.

Safety assessment of a casting workshop will provide a clearer understanding of the important safety level required for a foundry. The main purpose of this study was to construct a composite safety assessment method to protect employee health using the cloud model and cause and effect–Layer of Protection Analysis (LOPA). In this study, the weights of evaluation indicators were determined using the subjective analytic hierarchy process and objective entropy weight method respectively. Then, to obtain the preference coefficient of the integrated weight more precisely, a new algorithm was proposed based on the least square method. Next, the safety level of the casting workshop was presented based on the qualitative and quantitative analysis of the cloud model, which realized the uncertainty conversion between qualitative concepts and their corresponding quantitative values, as well as taking the fuzziness and randomness into account; the validity of cloud model evaluation was validated by grey relational analysis. In addition, cause and effect was used to proactively identify factors that may lead to accidents. LOPA was used to correlate corresponding safety measures to the identified risk factors. 6 causes and 19 sub-causes that may contribute to accidents were identified, and 18 potential remedies, or independent protection layers (IPLs), were described as ways to protect employee health in foundry operations. A mechanical manufacturing business in Hunan, China was considered as a case study to demonstrate the applicability and benefits of the proposed safety assessment approach.

Quantifying human error probability in independent protection layers for a batch reactor system using dynamic simulations

The batch processing facilities with features involving in large-scale human intervention are generally considered to be relatively hazardous processes due to frequent change in operating conditions. Therefore, sufficient protection layers should be implemented against the hazards inherent in the batch processing facilities, especially for batch reactor systems. The human operations involved in the batch process play an important role to maintain process production and also take responsibility for reducing risks in specific possible accident scenarios. However, in practice, a number of companies initially did not take any credits for human actions in Layer of Protection Analysis (LOPA) or were overly optimistic in a few cases, which result in unwarranted safety expenditures or inadequate risk reductions. In this study, we propose a simulation-oriented methodology for quantifying human error probability (HEP) in independent protection layers (IPLs). The methodology integrates dynamic simulations with human reliability analysis (HRA) to give a comprehensive analysis of human actions. Case study for a batch reactor system shows that risk reductions of human response are expected to be greater than that determined using other methods. The present study provides a solution for analyzing the risk reductions of human elements within the IPL and serves as a reference for improving the emergency response for operators.

Confirming the safety instrumented system layer of protection

AbstractThe safety instrumented system (SIS) is a complex protection layer with high reliability requirements. Assuring the effectiveness of the SIS requires monitoring the effectiveness of the safety instrumented functions (SIFs) as well as the independent protection layer(s) (IPL) that reduce demand on the SIF(s). An SIF tripping more frequently than anticipated may be due to flaws in IPLs intended to reduce demand on the SIF. A slower than expected or failed SIF trip may be due to flaws in the SIF components, the proof testing program, the maintenance program, or inadequate SIF design. This article will identify parameters that should be routinely monitored, illustrate how data can be captured and analyzed, detect weaknesses in the SIS IPL, and provide recommendations for routine monitoring and audit activities.

Integration of process control protection layer into a simulation-based HAZOP tool

This paper discusses the framework methodology behind the proposed simulation-based HAZOP tool. Simulation-based approach is one of the many ways to support conventional HAZOP by its automation. Compared to knowledge-based and other approaches, a HAZOP software tool based on deviations simulation is able to examine the investigated process more into detail and so find root causes of hazardous consequences. Another advantage is the ability to identify also potential hazards which did not occur in the past and might be overlooked. The presented framework methodology uses a layer of protection analysis (LOPA) concept of independent protection layers (IPLs) testing. Control system integrated into the raw process design represents the first of various protection layers of the LOPA concept. As a case study, a CSTR chemical production with nonlinear behavior under Proportional-Integral-Derivative (PID) actions as the predominant type of classical feedback control strategy is used. The presented tool identifies hazardous regimes under conditions when control loop introduces hazardous consequences or even acts synergically with existing hazardous events. Risk derived from different consequences is ranked by the risk assessment matrix (RAM) as a part of the conventional quantitative HAZOP study.

Understanding IPL boundaries

Layer of protection analysis (LOPA) is a simplified risk assessment tool that has been in use for almost three decades. The technique has improved the focus on independent protection layers (IPLs) that can prevent the progression of an initiating cause to an undesired consequence (a scenario). An IPL must be capable of preventing the scenario from reaching the consequence. To execute the simplified LOPA approach, the IPL must be independent of the initiating cause and other IPLs.A potential pitfall in LOPA and in the management of IPLs identified in LOPA is misunderstanding the boundary of the IPL.For example, a pressure relief valve (PRV) is intended as an IPL to prevent the consequence of catastrophic rupture of the vessel with potential for fatality. In reality, for the PRV to prevent vessel rupture, the inlet piping from the vessel to the relief valve and the outlet piping from the relief valve to the ultimate destination must provide sufficient flow capability. The IPL boundary must include any block valves in the inlet and outlet piping, and any devices such as flame arrestors or back pressure controllers. The probability of failure on demand (PFD) must include everything in the expanded IPL boundary.If the IPL boundaries are not correctly understood, the LOPA is not correct and the organization is deluding itself on the risk reduction.In addition to being independent and effective in preventing the consequence, an IPL must also be auditable. If an IPL boundary does not include all the components to make the IPL effective, the audit (inspection and testing) program will be incomplete. The PFD of the excluded—but needed—components will be higher than the PFD of the same components that are audited. Narrow IPL boundaries give two problems in calculating the correct PFD: (1) Needed components are not included in the PFD calculation, and (2) The actual PFD of excluded components is higher than it would be if the components were inspected.The article provides examples and illustrations for several types of IPLs: safety instrumented functions, dikes, relief device with fire‐resistant insulation and cladding on the vessel, operator response to alarm, and deflagration arrester. The article includes diagrams to illustrate the concepts. © 2018 American Institute of Chemical Engineers Process Saf Prog 38: e12019, 2019