PIZZINI (Phillips 66)

Phillips 66 has used LOPA since 2006 when we do our PHA studies. We apply it to the most severe events and use a scale of 1 to 5 for severity. So, if there is a Consequence 4 or 5, then we will apply LOPA to that event. Generally, those are the scenarios with a loss of containment component. We use the Initiating Cause Likelihoods (ICLs) from Table 5.1 from the Center for Chemical and Process Safety with some slight modifications, but that is our starting point. An example of an Initiating Cause Likelihood is basic control instrument loop failure, which is considered to happen once every 10 years or 10-1. The likelihood of human error on a routine task performed daily is also 10-1. Then you have a human error on a non-routine task performed under high stress, for which we assign a frequency of once a year.

When looking at consequences, it is key to remember to assign the consequence before taking any credit for the safeguards. An example would be an overpressure of a vessel. You must consider the failure of that vessel. We would not take credit for the PRV (pressure relief valve) when assigning the consequence. That would show up as one of the safeguards or layers of protection. When you assign an IPL (independent protection layer), every IPL, in and of itself, will have to be able to stop the event from progressing. So that is our methodology.

PIZZINI (Phillips 66)

Phillips 66 has used Layers of Protection Analysis since 2006 as the preferred procedure in association with a PHA to comply with ISA- S84. We apply LOPA to PHA scenarios with the potential for severe safety and environmental consequences. The “Initiating Cause Likelihood” (ICL) values from Table 5.1 of the 2001 CCPS Layers of Protection Analysis book are used with some company-specific clarifications and additions. For example, the ICL for a basic instrument 
loop failure is 1x10^-1, or once every 10 years. Likelihood for human error, on a routine task performed daily is also given a likelihood of 1x10^-1, but it has an increased likelihood of 1x10^0 for a non-routine task, in a high stress situation. 
Consequences are analyzed independently of the event's probability or frequency of occurrence. That is, the severity of the consequence is quantified on a scale from 1 to 5 before taking credit for safeguards or independent layers of protection. Each consequence category is then assigned a Targeted Mitigated Event Likelihood (TMEL), or frequency at which the incidents of a particular severity will not be tolerated. 

Each independent layer of protection (IPL) must prevent the consequence when it functions as designed.