CHAPTER 11

1. TUGAS K3 DALAM INDUSTRI KIMIA RISK ASSESSMENT CHAPTER 11 CHEMICAL PROCESS SAFETY – Fundamentals with Applications, 2nd Edition Daniel A. Crowl/Joseph F. Louvar SITI SITAWATI (NPM : 1006735574) Rev. 1 - 22 April 2011 DEPARTEMEN TEKNIK KIMIA - PROGRAM STUDI MANAGEMEN GAS PROGRAM PASCA SARJANA - UNIVERSITAS INDONESIA

2. CONTENTS 11-1 Review of Probability Theory 11-2 Event Trees 11-3 Fault Trees 11-4 Quantitative Risk Analysis (QRA) & Layers of Protection Analysis (LOPA)

3. 11-1 REVIEW OF PROBABILITY THEORY EQUIPMENT FAILURES Occur as a result of interaction of individual components POISSON DISTRIBUTION Probability that the component will not fail during the time interval (0,t): R(t) = e-mt (11-1) Where: R = reliability m = faults/time t = time

4. 11-1 REVIEW OF PROBABILITY THEORY • Plot Failures: • Failure Rate, m • Failure Density, f(t) • (c) Failure Probability, P(t) • (d) Reliability, R(t)

5. 11-1 REVIEW OF PROBABILITY THEORY P(t) = 1 – R(t) = 1 - e-mt (11-2) FAILURE PROBABILITY (UNREALIBILITY) MEAN TIME BETWEEN FAILURES Time interval between two failures of the component E(t) = MTBF = 1 / m (11-3)

6. 11-1 REVIEW OF PROBABILITY THEORY Typical Bathtub Failure Rate Curve for Process Hardware

7. 11-1 REVIEW OF PROBABILITY THEORY P = S Pi (11-4) Failure probabilities for individual components: Where: n = total number of components Pi = failure probability of each component Reliability probabilities for individual components: R = 1 - S (1 - Ri) (11-5) Where: Ri = reliability of an individual process component R = S (Ri)

8. 11-1 REVIEW OF PROBABILITY THEORY Failure Rate Data for Selected Process Components

9. 11-1 REVIEW OF PROBABILITY THEORY Computation of Component Linkage : • Simultaneous failure in parallel: logical AND function. • Simultaneous failure in series: logical OR function

10. 11-1 REVIEW OF PROBABILITY THEORY Immediately obvious to operator and can be fixed in a negligible amount of time Revealed Failures Component Cycles for Revealed Failures

11. 11-1 REVIEW OF PROBABILITY THEORY Without operator being aware of the situation until it affects Unrevealed Failures Component Cycles for Unrevealed Failures

12. 11-1 REVIEW OF PROBABILITY THEORY Mean time between failures (MTBF) for revealed and unrevealed: MTBF = 1 / m = tr + t0 (11-12) Where: t0 = time that the component is operational, period of operation tr = period of inactivity/downtime ti = inspection interval

13. 11-1 REVIEW OF PROBABILITY THEORY Probability of Coincidence: Is required when there are dangerous due to process upset occurs and unavailability of emergency system Average frequency of dangerous episode: Where: ld = dangerous frequency l = frequency pd = dangerous process episode U = unavailability of emergency system Ti = time interval

14. 11-1 REVIEW OF PROBABILITY THEORY Mean Time Between Coincidence (MTBC): Reciprocal average frequency of dangerous coincidences Where: ld = dangerous frequency l = frequency m = failure rate (failure/year) ti = inspection period (year)

15. 11-2 EVENT TREES Inductive approach that provides information on how a failure can occur and the probability of occurrence EVENT TREES • Used quantitatively if data are available on the failure rates of the safety function and the occurrence rate of the initiation event. • Useful for providing scenarios of possible failure modes. • Difficulty is that for most real processes the method can be extremely detailed, resulting in huge event tree.

16. 11-2 EVENT TREES • Event trees begin with an initiating event and work towards a final result with typical steps: • Identify an initiating event of interest • Identify the safety functions designed to deal with the initiating event • Construct the event tree • Describe the resulting accident event sequences

17. 11-2 EVENT TREES EVENT TREE for loss of coolant accident for reactor:

18. 11-2 EVENT TREES Computational Sequence in an Event Tree

19. 11-2 EVENT TREES Typical Event Tree of a Reactor

20. 11-3 FAULT TREES FAULT TREE Is a deductive method for identifying ways in which hazards can lead to accidents: Well-defined accident  top event  works backward toward the various scenarios that can cause the accident • Preliminary steps before actual fault tree is drawn: • Define precisely the top event • Define existing event • Define unallowed events • Define the physical bounds of the process • Define the equipment configuration • Define the level of resolution

21. 11-3 FAULT TREES Typical Fault Tree Contributing to a Flat tire

22. 11-3 FAULT TREES Logic Transfer Component of a Fault Tree

23. 11-3 FAULT TREES Typical Fault Tree of Reactor Overpressure

24. 11-3 FAULT TREES Minimal Cut Set • Is various sets of events that leads to top event. • Determined using Fussel & Vesely Procedure • Some of the minimal cut set have higher probability than others • Ordered with respect to failure probability Quantitative Calculation Using Fault Tree • Computation by Fault Tree Diagram, using AND gate & OR gate until top event • Computation by Minimal Cut Set Procedure

25. 11-3 FAULT TREES • Drawing Fault Tree: • Draw the top event at the top of the page • Determine major events that contribute to the top event • Parallel  connected by AND gate ; • Series  connected by OR gate • Determine major events that contribute to the top event • Determine intermediate events that contribute to the top event • Expand intermediate events that contribute to the top event

26. 11-3 FAULT TREES • Disadavantages of Fault Trees • For complicated process becomes enormous • Not certain if all failure modes have been considered • A particular item of hardware does not fail partially • Failure of one component does not stress the other components • Subjective dependence of individuals • Requires failure probabilities of all events in the fault tree

27. 11-3 FAULT TREES • Advantages of Fault Trees: • It begins with a top event, which is selected by user to be specific to the failure of interest • Used to determine the minimal cut sets, which provides enormous insight into various ways for top events to occur • Enables application of computers, which is available for construct fault trees, determining minimal cut set, calculating failure probabilities

28. 11-4 QRA & LOPA • Quantitative Risk Analysis • Identify where operations, engineering, or management systems can be modified to reduce risk. • Design to provide managers with a tool to help them evaluate the overall risk of a process. • Evaluate potential risks when qualitative methods cannot provide an adequate understanding of risks • Relatively complex procedure that requires expertise and a substantial commitment of resources and time.

29. 11-4 QRA & LOPA • Major steps of QRA study include: • Define potential event sequences and potential incidents • Evaluate incident consequences (typical tools for this step • include dispersion modeling and fire explosion modeling) • Estimate potential incident frequency using event trees and fault trees • Estimate incident impacts on people, environment, and property, and • Estimate the risk by combining the impacts and frequencies, and recording the risk using a graph

30. 11-4 QRA & LOPA • Layer of Protection Analysis • Semi-quantitative too for analyzing and assessing risk • Simplified methods to characterize the consequences and estimate the frequencies, • Various layers of protection are added to a process to lower frequency of the undesired consequences • Consequences and affects are approximated by categories, the frequencies are estimated, and the effectiveness of the protection layers is also approximated. • Individual companies use different criteria to establish the boundary between acceptable and unacceptable risk.

31. 11-4 QRA & LOPA Typical Layer of Protection Analysis of a Specific Accident Scenario

32. 11-4 QRA & LOPA • Major steps of QRA study include: • Identify a single consequence • Identify an accident scenario and cause associated with the consequence • Identify the initiating event for the scenario and estimating the initiating event frequency • Identify protection layers available for consequence and estimating the probability of failure on demand (PFD) for each protection layer • Combining the initiating event frequency with the PFD for the independent protection layers to estimate a mitigated consequence frequency • Plotting the consequences versus the consequence frequency to estimate the risk • Evaluating the risk for acceptability

33. 11-4 QRA & LOPA • Consequence • Most common scenario of interest for LOPA is loss of containment of hazardous material occurred through variety of incidents such as leak from a vessel, ruptured pipeline, gasket failure, release from a relief valve • Consequences are estimated using the following methods: • Semi-quantitative approach without the direct reference to human harm • Qualitative estimates with human harm • Quantitative estimates with human harm

34. 11-4 QRA & LOPA Semi-Quantitative Consequences Categorization

35. 11-4 QRA & LOPA • Frequency • Methods to determine frequency includes the following steps: • Determine failure frequency of initiating event • Adjust the frequency to include the demand • Adjust the failure frequency to include probabilities of failure on demand (PFDs) for each independent layer of protection • Probabilities of failure on demand (PFD) for each independent protection layer (IPL) varies from: • 10-1 for a weak IPL • 10-2 for a common practice IPL • 10-5 for a strong IPL

36. 11-4 QRA & LOPA • Three rules for classifying a specific system or action of an IPL: • IPL is effective in preventing the consequence when it function as designed • IPL functions independently of the initiating event and the components of all other IPLs that are used for the same scenario • IPL is auditable, that is, the PFD of the IPL must be capable of validation including review, testing, and documentation

37. 11-4 QRA & LOPA Frequency Values Assigned to Initiating Events

38. 11-4 QRA & LOPA • PFD concept is used when designing emergency shutdown system called safety instrumented functions (SIFs). • A SIF achieves low PFD figures by: • Using redundant sensors and final redundant control elements • Using multiple sensors with voting systems and redundant final control elements • Testing the system components at s specific intervals to reduce the PFD by detecting hidden failures • Using deenergized trip system (i.e., a relayed shutdown system)

39. 11-4 QRA & LOPA PFDs for Passive IPLs

40. 11-4 QRA & LOPA PFDs for Active IPLs and Human Actions

41. 11-4 QRA & LOPA Consequence Frequency of Specific Scenario Endpoint Consequence Frequency of Multiple Scenario Endpoint Where:

42. 11-4 QRA & LOPA • Safety Integrated Levels (SILs) for emergency shutdown system: • SIL1 (PFD = 10-1 to 10-2): implemented with a single sensor, a single logic solver, a single final control element, and requires periodic proof testing • SIL2 (PFD = 10-2 to 10-3): typical fully redundant, including the sensor, a single logic solver, a single final control element, and requires periodic proof testing • SIL3 (PFD = 10-3 to 10-4): typical fully redundant, including the sensor, a single logic solver, a single final control element, and requires careful design and frequent validation test to achieve low PFD figures.

43. THANK YOU