Layers of Protection Analysis

1. Layers of Protection Analysis ANGELA E. SUMMERS, PH.D., P.E. SIS-TECH Solutions, LLC We’re Proven-in-Use.

2. W3 W2 W1 - a - C 1 - 1 - a 1 - P 1 1 2 - F 1 1 1 a P 2 2 3 1 C 2 1 1 2 P 1 3 2 4 F 2 2 1 3 P 2 2 4 3 5 3 3 2 F 1 5 6 4 C 3 3 3 4 F 2 6 7 5 4 3 h C 4 7 8 6 Defining risk tolerance • Risk Matrix • Risk Graph • Quantitative PFDavg= Ft/Fnp = Tolerable Frequency Process Demand Frequency

3. Independent Protection Layer (IPL) Analysis Objective Intolerable Risk • Drive the consequence and/or frequency of potential incidents to an tolerable risk level Risk = frequency * consequence Tolerable Risk

4. Initiating Cause • Process Deviation • Initiating causes • Equipment failures • instrumentation • pumps • compressors • human errors • loss of mechanical integrity • Initiating cause frequency

5. Consequence • Based on detailed description of hazard scenario. • Examine safety, environmental, and economic risks. • Often considers the possibility of escaping the incident and the frequency of exposure to the potential incident. • Assessment may be qualitative or quantitative (consequence modeling)

6. Consequence Unmitigated Risk Unmitigated Risk • Incident Frequency = Initiating Cause Frequency • Consequence = Scenario Consequence Initiating Cause IS IT TOLERABLE?

7. Risk Tolerance • Compare unmitigated risk to risk tolerance. • If unmitigated risk is greater than risk tolerance, independent protection layers are required.

8. What are IPLs? COMMUNITY EMERGENCY RESPONSE • Independent Protection Layers are often depicted as an onion skin. • Each layer is independent in terms of operation. • The failure of one layer does not affect the next. PLANT EMERGENCY RESPONSE MITIGATION Mechanical Mitigation Systems Fire and Gas Systems PREVENTION Safety Critical Process Alarms Safety Instrumented Systems Basic Process Control Systems Non-safety Process alarms Operator Supervision Process Design

9. Independent Protection Layer Restrictions • Sufficiently independent so that the failure of one IPL does not adversely affect the probability of failure of another IPL • Designed to prevent the hazardous event, or mitigate the consequences of the event • Designed to perform its safety function during normal, abnormal, and design basis conditions • Auditable for performance

10. IPL • IPLs can provide • Prevention (active – lower probability) • Alarm with operator response • Safety Instrumented System • Mitigation (active – lower probability/consequence) • Pressure relief valve • Protection (passive – lower consequence) • Dikes • Mechanical design • Barricades

11. IPL1 IPL2 IPL3 Mitigated Risk = reduced frequency * same consequence Unmitigated Risk = frequency * consequence PFD1 PFD2 PFD3 Mitigated Risk – Reduce Frequency Only Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

12. IPL1 IPL2 IPL3 Mitigated Risk = reduced frequency * same consequence Unmitigated Risk Scenario Consequence Preventive Feature Preventive Feature Preventive Feature REDUCE FREQUENCY TO ACHIEVE TOLERABLE RISK Success Safe Outcome Safe Outcome Safe Outcome Initiating Event Success Success Failure Failure Consequences exceeding criteria Failure Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

13. PFD=0.1 PFD=0.01 PFD=0.1 Mitigated Risk = reduced frequency * same consequence Unmitigated Risk Scenario Consequence Preventive Feature Preventive Feature Preventive Feature Frequency = 0.9/yr Safe Outcome Frequency = 0.099/yr Safe Outcome Frequency = 0.0009/yr Safe Outcome Success = 0.9 Initiating Event Frequency = 1/yr Success = 0.99 Success=0.9 Failure = 0.1 Failure = 0.01 Frequency = 0.0001/yr Consequences exceeding criteria Failure= 0.1 Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

14. IPL1 IPL2 CMS1 Mitigated Risk = reduced frequency * reduced consequence Mitigated Risk = reduced frequency * same consequence Unmitigated Risk = frequency * consequence PFD1 PFD2 PFDN Mitigated Risk – Reduce Frequency and Consequence Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

15. PFD=0.1 PFD=0.1 PFD=0.01 Unmitigated Risk Mitigated Risk = reduced frequency * reduced consequence Different Scenario Consequence Occurs Preventive Feature Preventive Feature Mitigative Feature Frequency = 0.9/yr Safe Outcome Frequency = 0.09/yr Safe Outcome Frequency = 0.0099/yr Mitigated Release, tolerable outcome Success = 0.9 Initiating Event Frequency = 1/yr Success = 0.9 Success= 0.99 Failure = 0.1 Failure = 0.1 Frequency 0.0001/yr Consequences exceeding criteria Failure = 0.01 Key: Thickness of arrow represents frequency of the consequence if later IPLs are not successful Impact Event frequency

16. One SIL Assignment Technique SIL

17. Summary “A man is rich in proportion to the number of things he can afford to let alone.” Henry David Thoreau Industry will be judged on how it balances the preservation of life and the environment with the need for revenue and profits. Engineers are charged with achieving the balance.