Layer of Protection Analysis (eBook)

KEY QUESTIONS FOR PROTECTION LAYERS

• How safe is safe enough?
• How many protection layers are needed?
• How much risk reduction should each layer provide?

LOPA answers the key questions about the number and strength of protection layers by

• providing rational, semiquantitative, risk-based answers,
• reducing emotionalism.
• providing clarity and consistency,
• documenting the basis of the decision,
• facilitating understanding among plant personnel.

1. In the late 1980s, the then Chemical Manufacturers Association published the Responsible Care® Process Safety Code of Management Practices which included “sufficient layers of protection” as one of the recommended components of an effective process safety management system (American Chemistry Council, 2000). The Chemical Manufacturers Association is now the American Chemistry Council.

2. In 1993, CCPS published its Guidelines for Safe Automation of Chemical Processes (CCPS, 1993b). Although it was called the risk-based SIS integrity level method, LOPA was suggested as one method to determine the integrity level for safety instrumented functions (SIFs). (See Table 7.4 in Safe Automation; CCPS, 1993b.) “Interlock” is an older, imprecise term for SIF. The method used was not as fully developed as the LOPA technique described in this book. However, it did indicate a path forward, which was pursued by several companies independently. The reasons for this effort included the desire to

• classify SIF to determine the appropriate safety integrity level (SIL) (this was the starting point for some companies),
• develop a screening tool to reduce the number of scenarios requiring a full (chemical process) quantitative risk assessment (CPQRA),
• develop a tool that would identify “safety critical” equipment and systems to focus limited resources,
• develop a semiquantitative tool to make consistent risk based judgments within an organization,
• harmonize terminology and methodology with recently developed and developing international process sector standards, and
• facilitate communication (e.g., SIS, SIF, SIL, IPL) between the hazard and risk analysis community and the process control community (e.g., integrators, manufacturers, instrument and electrical engineers, plant personnel).

The initial development of LOPA was done internally within individual companies, in some cases focusing on existing processes, e.g., converting a control system to DCS. However, once a method had been developed and refined, several companies published papers describing the driving forces behind their efforts to develop the method, their experience with LOPA, and examples of its use (Dowell, 1997; 1998; 1999a; 1999b; Bridges and Williams, 1997; Fuller and Marszal, 1999; Lorenzo and Bridges, 1997; Ewbank and York, 1997; Huff and Montgomery, 1997). In particular, the papers and discussion among the attendees at the CCPS International Conference and Workshop on Risk Analysis in Process Safety in Atlanta in October 1997 brought agreement that a book describing the LOPA method should be developed.

In parallel with these efforts, discussions took place on the requirements for the design of safety instrumented functions (SIF) to provide the required PFDs (probability of failure on demand). United States (ISA S84.01, (ISA, 1996)) and international standards (IEC 61508, (IEC, 1998) and IEC 61511, (IEC, 2001)) described the architecture and design features of SIFs. Informative sections of the ISA and IEC standards suggested methods to determine the required SIL (safety integrity level), but LOPA was not mentioned until the draft of IEC 61511, Part 3 appeared in late 1999. These issues were summarized in the CCPS workshop on the application of ISA S84.01 (CCPS, 2000c).

In response to all this activity, CCPS assembled in 1998 a team from A. D. Little, ARCO Chemical, Dow Chemical, DuPont, Factory Mutual, ABS Consulting (includes former JBF Associates), International Specialty Products, Proctor and Gamble (P&G), Rhodia, Rohm and Haas, Shell (Equilon), and Union Carbide to tabulate and present industry practice for LOPA in this book.

This book extends the method outlined in Safe Automation of Chemical Processes (CCPS, 1993b) by

• developing concepts and definitions for use throughout industry,
• showing how numerical risk tolerance criteria have been developed by different companies,
• defining the requirements for a safeguard to be considered an independent protection layer (IPL),
• demonstrating how LOPA can be used for purposes other than the classification of SIF systems, and
• recommending documentation procedures to ensure consistency of application within an organization.

While the LOPA methods used by various companies differ, they share the following common features:

• a consequence classification method that can be applied throughout the organization;
• numerical risk tolerance criteria. Individual companies use different criteria which include:

• a method for developing scenarios;
• specific rules for considering safeguards as IPLs;
• specified default data for initiating event frequencies and values for IPLs;
• a specified procedure for performing the required calculations; and
• a specified procedure for determining whether the risk associated with a scenario meets the risk tolerance criteria for an organization and, if it does not, how this is resolved and documented.