BARNARD-CREEL-aeSolutions Impacts of Process …

1 GCPS 2015 _____ Impacts of Process safety time on Layer of Protection Analysis Geoffrey Barnard, , CFSE aeSolutions Anchorage, AK William Creel, CFSE aeSolutions Greenville, SC Prepared for Presentation at American Institute of Chemical Engineers 2015 Spring Meeting 11th Global Congress on Process safety Austin, Texas April 27-29, 2015 UNPUBLISHED AIChE shall not be responsible for statements or opinions contained in papers or printed in its publicationsGCPS 2015 _____ Impacts of Process safety time on Layer of Protection Analysis Geoffrey Barnard, , CFSE aeSolutions William Creel, CFSE aeSolutions Keywords.

2 Layer of Protection Analysis (LOPA), Independent Protection Layer (IPL), Process safety time (PST), IPL Response time (IRT) Abstract The ability of an Independent Protection Layer (IPL) to achieve a given level of risk reduction is dependent upon its fulfillment of several core attributes. A key provision for any IPL to be considered effective and functionally adequate is its capability to respond to a Process demand quickly enough to stop the propagation of the hazard scenario it was designed to prevent.

3 While this seems obvious and reasonable, the estimation of Process safety time and the specification of IPL Response Times is more complex, and often deferred or overlooked altogether. What is Process safety time ? How is it determined? When? And by whom? This paper examines the relationship between Process safety time and IPL Response Times, essential variables for the justification of IPL effectiveness, and their Impacts on the success of Layer of Protection Analysis (LOPA). 1. Introduction Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment technique commonly used to evaluate the likelihood of Process hazards and determine the necessary Independent Protection Layers (IPLs) to reduce the risk of a given consequence to a tolerable level.

4 Though many variations of LOPA have been developed in the years since its introduction, recent efforts by industry have focused on development of more universally accepted criteria for selecting and validating the assumptions and numerical values used in studies. The recent publication of the CCPS Guidelines for Enabling Conditions and Conditional Modifiers [1], and Guidelines for Initiating Events and Independent Protection Layers [2] have greatly expanded upon the guidance in the original LOPA text [3] while refining and reinforcing necessary considerations.

5 One particularly important area of expansion is in the definitions surrounding the timeline of a hazard scenario. Before seeking to define any aspects or requirements of a particular protection layer it is important to first understand how the unmitigated hazard scenario develops and how quickly. GCPS 2015 _____ 2. Hazard Scenario Timeline What is Process safety time ? According to the CCPS Guidelines for Safe and Reliable Instrumented Protective Systems Process safety time (PST) is: the time period between a failure occurring in the Process or its control system and the occurrence of the hazardous event.

6 [4] This is consistent with the definition found in the Guidelines for Initiating Events and Independent Protection Layers [2] as well as other industry standards applicable to the design of active protective systems. IEC 61511:2003 Part 2: the time period between a failure occurring in the Process or the basic Process control system (with the potential to give rise to a hazardous event) and the occurrence of the hazardous event if the safety instrumented function is not performed [5].

7 IEC 61508:2010 Part 4: period of time between a failure, that has the potential to give rise to a hazardous event, occurring in the EUC [equipment under control] or EUC control system and the time by which action has to be completed in the EUC to prevent the hazardous event occurring [6]. API 556 second edition, 2011: the interval between the initiating event leading to an unacceptable Process deviation and the hazardous event [7]. PST is not a specification, but rather a function of the behavior of the Process and Process equipment within the context of a specific unmitigated hazard scenario.

8 PST can be estimated, calculated, or potentially measured, but by extension of the definitions above PST is necessarily unique to each cause-consequence pair, even when multiple initiating events may eventually lead to the same consequence. This is because each initiating event has the potential to impact Process dynamics in different ways. Likewise, a single initiating event may lead to different outcomes due to inclusion of scenario modifiers, consideration of different operating modes, or consequences affecting different risk receptors.

9 PST of related but separate scenarios will not necessarily be equivalent. Determination of PST is the first step in identifying the time potentially available for all protection layers to respond and will be useful in specifying the required response time of each. PST is not dependent upon the parameters that make up the response of any one protection layer. Some resources in the past have defined PST in terms of the point of activation of a particular IPL. Such a definition is problematic in that it implies there is a different PST for each IPL, complicating the evaluation of a scenario as a whole.

10 These resources have attempted to define a means for estimating the time available for a particular protection layer to take action and affect the Process from a given point of activation, and while this is a worthy endeavor it should not be confused with Process safety time . GCPS 2015 _____ How is Process safety time determined? Unless measured in retrospect after a hazard has occurred, PST would be quite difficult to determine precisely. The exact conditions under which a hazard scenario may develop is argumentative, and it is not necessarily useful to consider PST to be a single specific value at which a hazardous event will immediately occur in all circumstances.