ESTEBAN (Suncor Energy, Inc.)

I have a lengthy description of LOPA itself to help address this question. Layers of Protection Analysis is the structured process used to determine the appropriate layers of protection required to provide adequate safeguards for adverse and sometimes catastrophic events in process units. As part of our Process Hazard Analysis standard at Suncor Energy, we follow LOPA as defined by the 2001 Center for Chemical Process Safety Concept of Layers of Protection Analysis. The LOPA process targets a ratio of 1:1 between the acceptable frequency of an event and the likelihood of the event.

 

 

The acceptable frequency of an event is inversely correlated to the risk ranking of the event and is displayed as the target mitigated event level, or TMEL. The event is evaluated for potential consequences without any safeguards in place and risk-ranked according to the Suncor Risk Matrix to determine the TMEL. The intermediate event likelihood, or IEL, is determined by multiplying the initiating cause likelihood (ICL) with the probability of failure on demand (PFD) of each of the independent layers of protection. The intermediate event likelihood can be calculated using other risk-reducing factors called conditional modifiers (CM) and enabling factors (EF); however, it is Suncor’s practice to be conservative and assume the factors are equal to one.

 

 

Slide three is simply a shot from the Safety Concept Book that shows initiating cause likelihoods and their likelihood of failure.

 

Slide four shows the probability of failure on demand for independent layers of protection. While the event likelihood can be easily defined using values provided in the text, the evaluation of the event consequences is an experience-based conjectural process. In order to appropriately determine consequences, it is important to have unit-specific and/or project-specific knowledge and experts as part of a PHA team to provide insight to the individual characteristics of the specific process in question.

 

In addition to process expertise, it is often critical to have a wide variety of members on the team, including those who can provide expertise on fixed equipment, rotating equipment, and process safety management. At Suncor, we typically attempt to build PHA teams with cross-functionality in order to provide the most accurate evaluation of event consequences. For example, at the Denver Refinery, with the recent revamp on our gas oil hydrotreater, we had a very diverse cross functional PHA team to provide the most appropriate evaluation. The revamp project provided additional heat exchange in the reaction and fractionation section, tray and tower modifications, an integrated pump around circuit, and heater modifications to allow for increased severity operation. A cross-functional PHA team included the PHA facilitator, PSM (process safety manager), area safety representative, project manager, project engineer, project and area process engineers, chief and unit operators, project mechanical engineer, project metallurgist, and project rotating equipment engineer.

 

LEICHTY (Chevron USA, Inc.)

Chevron does not use LOPA in PHA studies. We have an internal process called the Safety Objective Analysis that we do for all new units or existing units being evaluated for safety instrumented systems. Our method is similar to the LOPA, but there are differences.

 

The guidance that we have for this process comes from our Global Manufacturing Safety Instrumented System Leader and subject matter experts in the various process technologies. The method of determining consequences in the Safety Objective Analysis is similar to that determined by the LOPA. However, the quantification of likelihoods in the Safety Objective Analysis is not analogous to LOPA. For the likelihood analysis, we use internally developed guidance tables and consider enabling events, conditional probabilities, and non-instrumented safeguards.

 

 

ESTEBAN (Suncor Energy, Inc.)

Suncor Energy, Inc. employs the use of Layers of Protection Analysis (LOPA) in our OSHA-required Process Hazards Analysis (PHA). The Layers of Protection Analysis is typically performed following the Hazard and Operability Study (HAZOP) which ultimately provides a comprehensive list of potential scenarios and their corresponding consequences assuming no safeguards are in place to mitigate an event. The potential consequences identified in HAZOP are based on the experience and knowledge of the PHA attendees, including general industry knowledge as well. That is one of Suncor’s drivers for large cross functional PHA teams when performing whole unit and major project PHA evaluations. While Suncor currently does not have a corporate standard set of consequences for given scenarios, it is our intent to develop a standard that will drive consistency company-wide. The figure below depicts an example of cross functional PHA team members used for a revamp project on a gas oil hydrotreater.

 

 

Individual scenarios consequences are ranked in severity from low C1 to extremely high (catastrophic) C6 in accordance with our corporate risk matrix. Events with consequences at or above a threshold value of C4 are then evaluated using LOPA. In order to perform a LOPA an accepted frequency level for the event is established using correlated values for consequence rankings. Table 1 depicts the correlated acceptable frequencies as a function of consequence ranking. The acceptable frequency is presented as the target mitigated event levels (TMEL) which are values defined in terms of the consequence occurring per year or the probability of the consequence occurring in so many years. For example, a TMEL value of 1 X 10-4 is equivalent to the frequency or probability of occurring must not exceed 0.0001 times per year or 1 time per 10,000 years.

 

Each event is then associated to an initiating cause and the initiating cause likelihood (ICL) is assigned. The ICL is defined as the likelihood of failure in events per year given a certain initiating cause. The following Table 2 is used to define initiating causes and corresponding ICL values.

 

 

Following assignment of and ICL each event is evaluated for enabling factors (EF) and conditional modifiers (CM) as defined by CCPS LOPA text pages 67 and 33-40 respectively. However, at Suncor Energy, Inc. in accordance with our corporate standards we do not allow the application of enabling factors and conservatively do not apply conditional modifiers.

1 “Layer of Protection Analysis: Simplified Risk Assessment”; Chemical Process Safety (CCPS) Concept Book; American Institute of Chemical Engineers (AIChE) Centre for Chemical Process Safety (CCPS), 2001, p71. 2012

 

In order to achieve adequate layers of protection to reduce the probability of events as defined by the TMEL of the event, independent protection layers (IPL) are applied to the scenario. Each independent protection layer has a predetermined probability of failure on demand (PFD). This PFD defines the probability of risk reduction applied to the scenario for each given layer of protection. Table 3 displays the PFD values for given independent layers of protection.

 

A LOPA ratio of 1 or greater identifies and event that has adequate layers of protection, while a LOPA ratio of less than one identifies an event that requires additional layers of protection be defined or recommended to mitigate the probability of event consequences.

2 “Layer of Protection Analysis: Simplified Risk Assessment”; Chemical Process Safety (CCPS) Concept Book; American Institute of Chemical Engineers (AIChE) Centre for Chemical Process Safety (CCPS), 2001, p103