Layers of Protection Analysis ANGELA E SUMMERS PH

Layers of Protection Analysis ANGELA E. SUMMERS, PH. D. , P. E. SIS-TECH Solutions, LLC We’re Proven-in-Use. 1

Defining risk tolerance Risk Matrix Risk Graph Quantitative W 3 - 1 C 2 3 4 F 2 8 3 5 4 h C 4 4 6 7 2 3 4 F 2 3 5 6 C 3 1 3 3 F 1 2 42 5 1 2 3 P 2 a 1 1 2 P 1 - 2 3 - 1 1 P 2 - 1 2 F 1 - a 1 P 1 W 1 - a C 1 PFDavg= Ft/Fnp = Tolerable Frequency Process Demand Frequency W 2 7 3 6 2

Independent Protection Layer (IPL) Analysis Objective Drive the consequence and/or frequency of potential incidents to an tolerable risk level Intolerable Risk = frequency * consequence Tolerable Risk 3

Initiating Cause Process Deviation Initiating causes Equipment failures • instrumentation • pumps • compressors human errors loss of mechanical integrity Initiating cause frequency 4

Consequence Based on detailed description of hazard scenario. Examine safety, environmental, and economic risks. Often considers the possibility of escaping the incident and the frequency of exposure to the potential incident. Assessment may be qualitative or quantitative (consequence modeling) 5

Unmitigated Risk Incident Frequency = Initiating Cause Frequency Consequence = Scenario Consequence Initiating Cause Consequence Unmitigated Risk IS IT TOLERABLE? 6

Risk Tolerance Compare unmitigated risk tolerance. If unmitigated risk is greater than risk tolerance, independent protection layers are required. 7

What are IPLs? COMMUNITY EMERGENCY RESPONSE Independent Protection Layers are often depicted as an onion skin. Each layer is independent in terms of operation. The failure of one layer does not affect the next. PLANT EMERGENCY RESPONSE MITIGATION Mechanical Mitigation Systems Fire and Gas Systems PREVENTION Safety Critical Process Alarms Safety Instrumented Systems Basic Process Control Systems Non-safety Process alarms Operator Supervision Process Design 8

Independent Protection Layer Restrictions Sufficiently independent so that the failure of one IPL does not adversely affect the probability of failure of another IPL Designed to prevent the hazardous event, or mitigate the consequences of the event Designed to perform its safety function during normal, abnormal, and design basis conditions Auditable for performance 9

IPL IPLs can provide Prevention (active – lower probability) • Alarm with operator response • Safety Instrumented System Mitigation (active – lower probability/consequence) • Pressure relief valve Protection (passive – lower consequence) • Dikes • Mechanical design • Barricades 10

Mitigated Risk – Reduce Frequency Only IPL 1 Unmitigated Risk = frequency * consequence PFD 1 IPL 2 PFD 2 IPL 3 PFD 3 Mitigated Risk = reduced frequency * same consequence Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency 11

Unmitigated Risk IPL 1 IPL 2 Preventive Feature IPL 3 Preventive Feature Success Initiating Event Mitigated Risk = reduced frequency * same consequence Scenario Consequence Safe Outcome Success Safe Outcome Failure REDUCE FREQUENCY TO ACHIEVE TOLERABLE RISK Consequences exceeding criteria Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency 12

Unmitigated Risk PFD=0. 1 Preventive Feature PFD=0. 01 PFD=0. 1 Preventive Feature Mitigated Risk = reduced frequency * same consequence Scenario Consequence Frequency = 0. 9/yr Safe Outcome Success = 0. 9 Initiating Event Frequency = 1/yr Success = 0. 99 Success=0. 9 Failure = 0. 1 Failure = 0. 01 Failure= 0. 1 Frequency = 0. 099/yr Safe Outcome Frequency = 0. 0001/yr Consequences exceeding criteria Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

Mitigated Risk – Reduce Frequency and Consequence IPL 1 Unmitigated Risk = frequency * consequence PFD 1 IPL 2 PFD 2 CMS 1 Mitigated Risk = reduced frequency * same consequence PFDN Mitigated Risk = reduced frequency * reduced consequence Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency 14

Unmitigated PFD=0. 1 PFD=0. 01 Mitigated Risk = reduced Risk frequency * reduced consequence Different Scenario Consequence Occurs Preventive Feature Initiating Event Frequency = 1/yr Preventive Feature Mitigative Feature Frequency = 0. 9/yr Safe Outcome Success = 0. 9 Frequency = 0. 09/yr Safe Outcome Success = 0. 9 Success= 0. 99 Failure = 0. 1 Frequency = 0. 0099/yr Mitigated Release, tolerable outcome Frequency 0. 0001/yr Failure = 0. 01 Consequences exceeding criteria Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

One SIL Assignment Technique SIL 16

Summary “A man is rich in proportion to the number of things he can afford to let alone. ” Henry David Thoreau Industry will be judged on how it balances the preservation of life and the environment with the need for revenue and profits. Engineers are charged with achieving the balance. 17