Considerations for Layer of Protection Analysis for Licensed Plant

Transcription

1 Considerations for Layer of Protection Anaysis for Licensed Pant Jo Fearney Senior Consutant, Aker Kvaerner Consutancy Services, Aker Kvaerner, Ashmore House, Stockton on Tees, TS18 3RE, UK E-mai: Chemica pants are routiney buit around the word using a standard process design package suppied by the icensor of technoogy. Typicay incuded in the package is the identification of the instrumentation to be incuded within the emergency shut down system, and the required safety integrity eve identified for each safety instrumented function. These are presented as necessary requirements to meet the icensor s interna minimum safety standards. Other requirements to meet minimum safety standards are aso often incuded, such as mandatory procedures. The input to, and detai of, the assessment on which these requirements are based is not provided within this icensed process design package. This raises the question of what additiona safety studies are required as part of the engineering design package. This wi depend on a number and variety of factors; these wi be discussed, with exampes, and the impications for SIL assessment debated. Background A icensed process design package (PDP) is rapidy becoming the most common basis for chemica pant expansion across the word. Tried and tested designs for producing a wide range of chemicas are icensed by technoogy owners, and the cient pays a premium for the benefit of investing in a design which is known to deiver a quaity product. The basic process wi remain unchanged, athough progressive improvements to equipment design or catayst may be part of the evoution of the design over the years. The actua scope of the icensed PDP wi differ from one chemica to another as typicay the PDP is targeted at those aspects of the design where a change to the base design coud affect the end product. Hence, athough the reaction and purification unit operations are fundamenta to the process, other activities, such as raw materia handing, raw materia purification, catayst charging, separation, recyce and product handing, may or may not be within the scope of the icensed process. It is therefore not possibe to tak about the standard content of a PDP, and hence what wi not be incuded. When companies deveoped, designed, constructed, commissioned and operated their own process pants they were in contro of the associated safety studies, even if a contractor was used for the detaied design and construction aspects. In such cases the progression of successivey detaied hazard studies, such as the six stages of hazard study originay deveoped by ICI pc in the 1960s, was part of the standard design process for many arger companies. As a resut these studies were we controed, documented, monitored, and comprehensive.

2 However, with icensed pants the structured progression through a series of studies often gets ost in the deveopment from front-end design to detaied design to construction to commissioning and eventuay operation. The confusion is increased by the frequent switch between contract companies at the various stages, eading to a ack of continuity in both personne and communication/information fow. Underying the requirements for safety studies at different stages in the design process is the information provided by the icensor and the standards required by the cient. Between the two is the contractor, who needs to take great care to understand the discrepancy between the icensor suppy and the cient demand such that it is adequatey covered in the bid and the programme. The risk is that in the commercia drive to reduce costs and win the contract this coud be overooked. Dependent on the scope of the contract, consideration wi need to be given to those aspects of the design within the PDP and those outside the icensor s remit, but within the contractor s remit; i.e. the off-pots. The situation is further compicated by eements of the design which are outside battery imits (OBL), i.e. to be competed by others, or aready existing. There wi frequenty be differing safety, heath and environmenta (SHE) assessment requirements for the PDP, the off-pots and the OBL interactions. The usua situation is that the PDP wi contain some integra hazard studies, whist none of the off-pots wi be covered, and information regarding the OBL interactions wi depend on their buid status compared to the icensed pant. As part of my roe as a risk consutant for Aker Kvaerner Consutancy Services I am routiney invoved with the range of risk assessments required for icensed pants. One aspect of this consutation is the fundamenta question: What safety, heath and environmenta assessments do we need to do? Unfortunatey there is no singe answer to this question as the combination of the icensor, the cient, the contractor and the contract itsef mean that every project is totay individua. This paper discusses the issues raised by this uncertainty when considering the requirement for safety instrumented functions (SIF) to compy with EN In order to determine the safety instrumented functions for a pant, and the other design and operating aspects which provide prevention, contro or mitigation of hazardous scenarios, a detaied hazard identification for the whoe pant is necessary, which covers the areas within the PDP and those within the off-pots. It is not possibe to cover the areas outside battery imits, but an awareness of impact on. and from. these is needed to be comprehensive.once the hazardous scenarios have been identified, typicay at an eary stage in the project, the design shoud, where possibe, provide inherent design features which eiminate the risk, or, where this is not possibe, prevent, contro and mitigate that risk. The assessment of the identified hazardous scenarios, considering the design of the pant, is frequenty done using the ayer of protection anaysis (LOPA) methodoogy from EN for process pants, to identify the reevant protective features of the design and utimatey determine the instrumented systems which are required to have a safety integrity eve (SIL) rating. 2

3 As a simpistic starting point it is normay the case that for a icensed pant design the section within the PDP wi have the SIL ratings of the SIFs identified, whereas the off-pots wi not. Process Design Package PDP The icensor wi have competed safety studies as part of the deveopment of the PDP, and the design wi aso typicay have been deveoped over the years to incorporate operationa experience. However the PDP sedom, if ever, incudes the SHE assessments in a form which is comprehensive and easiy transferabe between icensor and cient. It is this ack of definitive documentation which eads to the question What safety, heath and environmenta assessments do we need to do? At any stage in the design process, the basic questions to ask are: What has aready been done? What is avaiabe? What does the contract require to be done? What does good/best practice require to be done? What safety targets/risk toerabiities are required/appropriate? Unfortunatey, just because a risk assessment has aready been competed does not mean that it is avaiabe for direct use. For exampe the icensor wi have a wide range of prevention, contro and mitigation features buit into the design of the PDP suppied. However what is often acking is the fu detai of the competed hazard assessments which ead to the design as it stands. A document commony provided as part of the PDP is the ist of aarms and trips for the pant, which need to be part of the independent safety system rather than part of the basic process contro system (BPCS). For these instrumented safety systems the required safety integrity eve (SIL) wi aso be provided within the PDP. The process trips within the design which are not subject to a SIL rating are those within the design of the BPCS. The detaied assessment which determined which are SIL rated and which are not is not normay avaiabe; ony the output detaiing those hazards determined by the icensor as requiring specific design or operationa features wi be avaiabe. This assessment is often referred to as the PDP ayer of protection anaysis (LOPA) document. The document is, however, not caibrated or quantified, but simpy contains a ist of scenarios and the requirements for associated procedures, aarms and (SIL rated) trips. This is the fundamenta cause of differences between projects, as for some cients it is enough to accept the standards set by the icensor, whist others insist that their own company standards are appied to a new buid projects. For the former the suppied design can be used as the basis for the project, whereas for the atter it may be necessary to compete a risk assessments to the cient standards and hence ater the PDP if there is a discrepancy in integrity eves determined. For icensed technoogy it is part of the icense that it is ony acceptabe to increase the safety functions, not decrease them. The underying factor which affects this is that the risk criteria on which the icensor has based the risk assessments are not typicay avaiabe for comparison with the 3

4 standards of the cient. Such risk criteria are often considered confidentia and not something which a company wishes to be shared, as they are perceived as a refection on the company concerned if they are not as restrictive as someone ese s criteria. However to compete a safety integrity eve assessment, either using a risk matrix or ayer of protection anaysis requires that the criteria for the boundaries between intoerabe, toerabe and broady acceptabe eves of risk are quantified. The interaction between the frequency of an event occurring and the severity of that event wi determine the risk arising from the event, and hence its acceptabiity. To reduce the risk the frequency and / or the severity needs to be reduced. To compound the probem, it is normay obvious from the output data numbering which is suppied within the PDP LOPA report that there are a arge number of scenarios which were in the origina icensor assessment for which the output has not been suppied; i.e. ony those scenarios deemed significanty hazardous to require instrumented systems, or mandatory procedures to address them are incuded. The probem with this approach is that it is therefore not obvious which other design or operationa features have been assumed by the icensor as the protection against the various scenarios. The icensor s argument is that the requirements are buit into the PDP, and hence provided it is designed to the stated requirements the other scenarios wi be adequatey covered. This is fine where the resoution of the risk is covered by an inherent protection feature, e.g. that the equipment design temperature is high enough such that it cannot fai, or the reief device is sized to reief the pressure safey, or a vent is routed to a fare to address environmenta issues. However some of the basis of the risk assessment may be a function of the toerabe risk accepted by the icensor, or may be based on assumptions about the environs of the cient s site which are not vaid. Incuded within the PDP LOPA are physica, mechanica and inherent ayers of protection, as we as contro and operationa considerations, which may not be specificay highighted as ayers of protection. This means that if there are any changes to the standard design it is not immediatey apparent whether the SIL requirements are affected, as the change coud affect a scenario not identified as having a SIL impication in the icensor package. It is therefore very important that any change in the design from the basic icensor package is specificay assessed for reated hazardous scenarios and hence for potentia SIL requirements, which can ony be done in conjunction with the icensor. Exampes of these ayers of protection incude reief devices (pressure and vacuum), bunds, fare systems, vent headers, design conditions of equipment and pipework, restrictive devices and equipment types. Care needs to be taken with any change as in some cases what may appear a positive change, such as increasing the ground area of a bund, coud have a negative effect as it coud increase the size of a poo fire and hence the radiation effect. Location-reated factors affecting the PDP SIL assessments There are other genera factors which may affect the icensor LOPA which has resuted in the identified SIL requirements. These incude ayout, geographica considerations, operating phiosophy or popuation density. The risk criteria used as the basis for the SIL 4

5 assessments for the PDP wi be based on a standard pant environment, and is very unikey to have been adjusted for the specific environment in which the cient pant wi operate. Due to the ack of underying information regarding those hazards which have been screened out, it is difficut to determine whether the cient specific environment wi change the risk assessment. An easy ocation specific factor may the vunerabiity of the cient site to certain geographica effects, which wi not be part of the basic design package. An exampe is if the cient site wi be in a region prone to earthquakes, in which case there wi possiby need to be vibration/motion trips that initiate the shutdown of a hazardous instaation that woud not be in the standard icensor package. Aternativey if it is in a desert then sand may invaidate a particuar protective measure such as a bund, as sand buid-up may restrict the capacity avaiabe uness additiona precautions are taken. A further exampe is if the site is in a region prone to fooding, which may bock drainage routes eading to an unexpected poo fire. Changes to the ayout may affect the SIL cassification identified for a particuar risk, as the consequentia effects may be different. For exampe, if the occupied buiding ocations are changed compared to potentia fammabe reease sources then this coud change the number of peope who coud be at risk if an event were to occur. Consideration is needed not ony of the pant to be icensed, but aso any other production units which are cose enough to have an inter-pant effect. Higher numbers of peope coud aso be at risk if the pant is to be ocated near to a site boundary with a popuation iving cose to the externa boundary. Operating phiosophy changes may change a SIL cassification, as the exposure/ vunerabiity of the operating personne may be changed. Modern pants are typicay intended to be remote-operated, and as such have a ow time at risk factor for certain events with a ocaised effect as a ow proportion of time wi be spent on site. However if a manua operating regime is panned then this ayer of protection factor wi not be vaid. It wi be necessary to consider and discuss a these potentia factors between the icensor, cient and contractor to ensure that the fina design appropriatey considers the risks, and reevant SIL assessments may need to be reviewed to assess the vaidity of the data and hence the design basis of the PDP. Part of this consideration is the awareness that SIL cassification is an order of magnitude technique, so a significant change is one which has an order of magnitude effect on the ayer of protection anaysis. This is compicated by the fact that the origina LOPA may have identified, for exampe, a SIL 1 requirement for a SIF, but this anaysis was right on the boundary between the SIL 1 and the SIL 2 resut. Hence it is possibe that a sma change coud move an assessment into the next eve of required protection, and without the vaues used in the origina PDP LOPA it is not possibe to identify the scenarios where this is the case. This is further compicated where a scenario had not been SIL cassified initiay, and yet a change may take it to SIL 1. Underying a these considerations if the principe of whether the cient/oca directives require that the as ow as reasonabe practicabe (ALARP) or so far as reasonaby practicabe (SFARP) principes are appied, and whether the icensor package utiises 5

6 these principes. This coud add a significant eve of compication to the discussions about acceptabe risk criteria, and is highighted here, but is not further discussed. Consideration of off-pots and SIF requirements utiities The utiity requirements of the site wi be different dependant on whether the new pant is on a brown-fied or green-fied site; what faciities aready exist; what is being buit in the same timescae; and what the pans for the future are. As a resut the utiity requirements for a icensed pant are sedom, if ever, incuded in the basic PDP as the demands are endessy variabe. The effect of the oca environment on the utiity requirements aso changes the specification significanty. As such the ony standard statement for a icensed pants is that the utiities wi need to have a series of appropriate SHE assessments competed during the ifetime of the project, incuding a hazard identification process which wi enabe appropriate assessment of the risks identified to enabe the SIL assessments to be competed. These wi need to consider not just the icensed pant which is the subject of the project, but aso the interactions between the other pants on the compex. Therefore even the scope of such studies wi not be cear cut, as the utiities may be part of the off-pots or provided by the cient or a third party as a series of OBL connections. In the atter case the safety studies wi need to focus on what the project effect coud be on the OBL pant, and what the potentia effects of the OBL faciities coud be on the project. Hence the critica aspect in this case is cear communication and two way transfer of information to ensure that a mutua concerns have been addressed. The utiities incude not just steam, water, nitrogen, air etc, but aso fare systems, waste treatment systems and pre-treatment systems as necessary. There can therefore be a significant scope in the utiities aspect of a icensed pant that needs to be considered. For different projects the variabiity of icensor, cient, contractor and stage in the process design wi mean that it wi not be certain that the SIL assessments wi have been competed, so an initia check for the SIL assessment status at the transfer of a icensor project into a new stage is good practice. Consideration of off-pots and SIF requirements raw materia and finished product handing The other areas which may fa into the off-pots scope are raw materia and/or finished product handing faciities. Again this is because the scope can vary so widey between faciities, as it depends on what is aready present. The suppy of raw materias, for exampe coud range from a suppy pipeine from an upstream, integrated source, through to transport offoading faciities and significant storage, handing and purification systems. Catayst and additive handing may be additiona or incusive in the PDP. The finished product handing is sedom incuded in the PDP as the requirements for storage or packaging wi depend on the oca infrastructure and transport situation. 6

7 As for the off-pots utiities these aspects of the off-pots wi need appropriate SHE studies to be competed, incuding a hazard identification process eading to SIL assessments. The compexity and extent wi depend on the hazards of the materias to be handed. These areas can be quite extensive for some process pants, and hence a significant amount of resource may need to be committed to the SIL assessments, and as for utiities the comprehensiveness of the SIL assessment data avaiabe needs to be reviewed when a project moves from one stage in the design process to another, and/or from one contractor to another. PDP SIL requirements safety, environmenta and financia The SIL requirements indicated within the PDP LOPA report are based on the requirement to protect against human harm, and usuay to protect against environmenta harm as we. However, they wi sedom, if ever, incude protection against financia / asset oss. Therefore, in addition to considerations of the differences between cient and icensor risk criteria for human and environmenta harm, the contract needs to be very cear on whether there are risk criteria to be considered for financia and / or asset oss. The eve of acceptabe risk for financia oss is even more variabe between companies than that for human harm or environmenta damage. Consideration of financia oss can ead to significant changes in instrumented systems, typicay around equipment which on catastrophic faiure coud ead to significant outage, oss of revenue and / or repacement costs whist not necessariy having a high eve of safety or environmenta risk. This issue becomes even more compicated if there are reiabiity and avaiabiity causes within the contract, as instaing additiona instrumented functions to protect against equipment damage coud ead to spurious trips, eading to additiona downtime. The cost of such instrumented functions can therefore escaate significanty if buiding in dupication and voting systems to get the correct baance between protection against faiure to operate and protection against spurious operation. Aarm response and contro actions affecting SIL requirements There is one area which can have a significant impact on the PDP LOPA acceptabiity to a cient. This is when the cient does not accept response to an aarm as a vaid ayer of protection. This is not common, as the IEC 61508/61511 standards aow aarms and contro actions to be considered as ayers of protection where they are independent from each other, athough with a imited probabiity of success, but there are companies where their interna standards are stricter than the IEC standards. In this case a the reevant SIL assessments wi need to be reviewed and aternative protection identified, or SIL requirements changed appropriatey. However it is ony for the scenarios identified in the PDP LOPA report where this can be readiy achieved, and there may be other scenarios where the use of an aarm response has reduced the risk sufficienty for the scenario not to be isted. It is therefore necessary to have direct discussion between the interested parties to address the issue. Where direct response to an aarm is not

8 typicay considered a ayer of protection by a cient this may be overcome by incuding a written procedure for the response to the aarm, to increase the integrity of response. However this is cient dependent, and in reaity the response time avaiabe between aarm and incident needs to be sufficienty ong to enabe a procedure to be accessed, read and acted upon for this to be a rea ayer of protection. Another difference specific to certain cients is the number of ayers of protection within the contro system which it is acceptabe to consider in a SIL assessment. Norma practice imits contro systems to providing a maximum of two independent ayers of protection, and care must be taken to assure true independence of these within the contro system. Detaied consideration of the potentia for common mode faiure of the contro system, which woud affect the independence, is needed. Common mode faiure mechanisms coud occur due to a variety of causes, such as input/output cards, parae cabe routing, physica ocation, common equipment suppier or dupicated equipment types. It the cient ony accepts a singe ayer of protection reating to the contro system, taking a pessimistic view the one faiure coud affect the whoe contro system, then a simiar review to that detaied for the aarm response is required. Achieving SIL requirements for the fina design As the data is not avaiabe, it is often a subjective view as to whether the icensor package identified SIL requirements and other specified ayers of protection are equivaent to those which woud have resuted from a SIL assessment based on a cient caibrated risk graph. One method to overcome this concern is to reassess a representative seection from the suppied PDP LOPA report, using the cient risk criteria. If the assigned vaues seem to be comparabe, then the assessment is usuay accepted, but where it appears to be underestimated then a decision needs to be taken as to whether to compete a comprehensive, or partia, process hazard and SIL assessment for the design package, in order to satisfy the cient interna standards. To achieve the specification of the SIL requirements for the fina design a the above aspects need to be consoidated into a singe package. The use of LOPA to determine that a SIL rated safety instrumented function is required is just the start of the process. The actua achievement of the ayers of protection identified is part of the detaied design package, considering the compete SIF design, equipment specification, instaation, maintenance, proof testing, and auditing. REFERENCE Fearney, J., 2007, Safety Integrity Leves Considerations for New and Existing Assessments, 12th Internationa Symposium Loss Prevention and Safety Promotion in the Process Industries, 2007, Edinburgh 8