A LOPA Implementation

Method
Breydon G Morton
DuPont
Standards October 3, 2007
Certification
Education & Training
Publishing
Conferences & Exhibits

Copyright 2007 by ISA, [Link]

Presented at ISA EXPO 2007, 2-4 October 2007, Reliant Center, Houston, Texas
What does LOPA mean to DuPont?

• Before we (DuPont) implemented LOPA?

• How are we implementing LOPA ? Tasks?

2
Before implementing LOPA

• Questions and Background data

– Is Company ready for LOPA?
– Current Foundation for Risk Assessment?
– When is LOPA Used?
– Risk Tolerance Established?
– Data Required?
– IPL”s Remain In Place?

3
Risk Management Philosophy?

• Values & Beliefs vs. Risk Management Strategy

– Core Values (Safety & Health, Ethical Behavior, Respect for
People, and Environmental Stewardship )
• Process Safety Management
– Control Risk
• Standards and Policies
– Risk Reduction > Protect (Assets, People, Environment, Public
Trust)

4
Current Foundation Risk Assessment

• Experience & Capabilities Assessment ?

– Current Risk Management Policies
‰Policy Process Safety Management (PSM)
Manual
‰Standards S21A (PSM), S25A (PHA)
– Hazard Analysis Methods
‰Checklists, What-If, HAZOPS, Fault Tree
– Institutional Knowledge (Consequence & Failure
Frequencies)
‰Specialized Resources from Process Safety
& Fire Protection (PS &FP)

5
Risk Tolerance Criteria

The typical industry risk tolerance for combined events that

could result in irreversible human health effects, which is
used to make risk reduction decisions, is 10-4.

(Appendix E of CCPS “Layer of Protection Analysis”)

6
When is LOPA used?

• Within DuPont, when evaluating risk of process safety

scenarios there is a need to recommend additional safety
protection for risk mitigation.
• When the hazard evaluation analyst determines that a
“Risk Based” approach is required and interlock design is
needed.
• When a PHA team believes a scenario is too complex to
make a risk judgment using purely qualitative judgment.

7
From Consequence severity… When is LOPA used?
– PHA teams are responsible for assigning worst case consequence severity (i.e. assuming
loss of all engineering & administrative controls) using the consequence categories as
defined in LOPA guidance document Table 12.2a or S25A.
– 3. …
– 4. Conduct an interlock evaluation as follows:
A. As part of hazard evaluation, identify those events that involve interlocks (existing,
recommended, and being considered)
B. Evaluate the consequence category for the event
1. If the consequence category is C1 or C2 then the interlock is a process interlock and should be
documented accordingly in the PHA. If the same interlock is identified as a safeguard against multiple
events then the most severe event will determine the final categorization and SIL.
2. If the consequence is financial loss only, then the interlock is a process interlock. For process
interlocks mitigating financial loss hazards only, the AIB method may be used to determine the
reliability requirements. See DX3S for a description of AIB method.
3. If the consequence category is C3, then further evaluation must be done to determined the required
SIL of the interlock. The AIB method may be used to determine the reliability
requirements. See DX3S for a description of AIB method.
4. If the consequence category is C4 (excluding multiple fatalities) , then further evaluation must be
done to determined the required SIL of the interlock. The AIB method may be used to determine
the reliability requirements. See DX3S for a description of AIB method.
5. If consequence category is C4 with multiple fatalities , then a risk-based (LOPA, Event Tree,
Fault tree) must be used. Application of a risk-based method requires that personnel trained in
process hazards analysis and the method being used, be involved.
Risk-based methods may also be applied to any hazard where the AIB method is allowed.

8
Data Required

• Consequences
– Standard S25A Æ Tables 12.2a & bÆ C4 through C1
– Modeling (Scenario impact ; Potential severity)
• Component Failure Data
– DRAFT LOPA Guidance manual Table 10.2 Passive IPL’s and
Table 10.3 Active IPL’s
– DX3S Table 3 MTTFfd device values
– Vendor data
– General industry
• Initiating Event
– DRAFT LOPA Guidance manual Table 10.1 Frequency
Initiating Events

9
 Table 12.2a Consequence Severity

Table 12.2a Consequence Severity

Type of Event/ Consequence Consequence Consequence Consequence
Impact Category C-1 Category C-2 Category C-3 Category C-4
Minor Moderate Major Catastrophic

Employee No Injury of Minor (MTC) Multiple MTC One or more

Safety and health impact injury of injuries; 1-2 fatalities;
Health reversible RWC/LWC’s Multiple LWC’s
health effects with irreversible
health effects
Public Safety No injury or Minor injury of Injury or Death or
and Health health effects reversible moderate health irreversible
health effects effects; heath effects:
Emergency
medical
intervention
and/or
hospitalization

10
 Table 10.2 Passive IPL’s
IPL Comments PFD for DuPont LOPA

Dike Will reduce frequency of large 10-2

consequences (widespread spill)
of a tank overfill/rupture/spill/etc.
Underground Drainage Will reduce frequency of large 10-2
System consequences (widespread spill)
of a tank overfill/rupture/spill/etc.
Open Vent (or no valve) Will prevent overpressure 10-2
Fireproofing Will reduce the rate of heat input 10-2
and provide additional time for
depressurizing/firefighting
Blast Bunker Will reduce the frequency of 10-3
large consequences of an
explosion by configuring blast
and protecting
equipment/buildings/etc.
Flame/Detonation Arrestors If properly designed, installed 10-2
and maintained these should
eliminate the potential for
flashback through a piping
system or into a vessel or tank.
11
 Table 10.3 Active IPL’s

IPL Comments PFD for DuPont LOPA

Relief Valve 10-2 (2)

Rupture Disc 10-2 (2)

Basic Process Control 10-1

System
SIL 1 10-1 (3)
SIL 2 10-2 (3)
SIL 3 10-2 (3)
Battery Backup UPS with 10-1
periodic inspection
Water Scrubber, 10-1
maintained and inspected
Battery Backup UPS with 10-1
periodic inspection
Etc… Etc…

12
Table 3 MTTFd device values

Equipment Type Unsafe MTTFd (years)

Sensors Current Switch 25 to 35

Flame Detector 15 to 20

Etc… Etc…

Logic Solvers Electromechanical relay 1500 to 2500

per DX8S
Pre-configured SIS PEC 100 to 120
logic solver
Etc… Etc…

Final Elements Valve positioner 25 to 30

Motor Starter 1000 to 1500

Pilot solenoid 25 to 35

Etc… Etc…
13
Table 10.1 Frequency of Initiating Events
Initiating Event Value for DuPont LOPA
(per year)
Cooling water Failure 10-1
Regulator Failure 10-1
Operator Failure ( to 10-2 per opportunity
execute routine procedure,
assuming well trained,
unstressed, not fatigued
)(PFD)
Variable speed motor AC 10-1
motor failure
Loss of electrical power, 10-2
dual feed systems
Loss of nitrogen supplied 10-1
by pipeline
Etc. Etc.

14
 Documentation LOPA Worksheet
Intrmd
d / or Scenario # refres to WHAT-IF Item.
Severity
are events per year, other numerical values are average probabil Event PFD of SIF
Level Likelihood
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
INDEPENDENT PROTECTION LAYERS
Impact Severity Initiating Initiating Enabling General BPCS Operator Additional IPL Mitigated Likelihood Likelihood Frequency Notes
Event Level Cause Event Event Process Response Mitigation, Additional Intermedia Event of person of of
Frequency Frequenc Design to Alarms, Restricted Mitigation, te SIF ID Likelihood in area Significant Significant
y etc. Access Dikes, Event PFD Injury Injury
Pressure Likelihood
Relief
Overpress C4 [Link] 0.100 1 1 1 1 0.01 0.1 1.0E-04 1.00E-01 1.0E-05 Tolerable
ure TC-2, from A-206 Risk
release of to TC-2, Criteria of
toxic P1527 XXXX
(HFA, failure IPL’s met. SIL
1 for SIF
HFIP, H2)
needed
material/
and met.
flammable;
catastroph
ic

W932596 No. 8 in DRAFT Two check TC-2 PRD S-1b

rev 42F, WhaIf LOPA valves in 1205 Conceptu
Document- HFA al Design :
DW 49060
Rev 2N,
was
analyzed AC Electric transfer
0141 set
@ 200 2460DPG
Mitigated
motor line, clean Low Low
DW44540 for
failure) service.
psi; {Has
rupture (2460PT -
Event
Rev 18J "backflow
Will be 1822PT)
" only . It
checked
disc]
closes
Likelihood
did not back to
or 1825HV
identify "Emergen
replaced via MLC2.
cause for on a
cy"
"backflow regular Scrubber
". LOPA frequency , SB-126
identified so credit operated
a discrete taken. as
cause "passive"
(P1527 scrubber.
failure). Initiating Cause since
pump not
and Frequency operated,
but
instrumen
ted with
local
temperatu
Impact Event re
controller, 15
and level
IPL’s Auditing

Periodically assess IPL’s

9 Functional testing (SIF’s, Relief valves, etc.)
9 Periodic inspection (Dikes, machine guards etc.)
9 Preventive or replacement maintenance (Corrosion coupons
and vessel thickness checks)

16
Implementation Tasks

• LOPA Guidance Document

– ~ 59 pages
– Target Audience : PHA Teams/Management, LOPA Analyst &
Corporate
– Purpose : Broad Overview of LOPA; definitions; IPL values; initiating
event frequencies.

• LOPA Training Course and Training LOPA Analysts

– 1-1/2 day Training course (In-house)
– For in-house LOPA analyst certification
‰ LOPA analyst in training ( Participate in LOPA’s with experienced, in –
house certified LOPA analyst)
‰ Lead several LOPA’s independently
‰ Present LOPA examples for peer review by team of qualified LOPA analysts

17
Points to Remember…

• Are you (organization) ready

for LOPA?
– Risk Management Philosophy
– Current Foundation Risk
Assessment
– Risk Tolerance Criteria
– Data Required
• Are you (organization) up for
the tasks?
– Training
– Guidance Document
– IPL Auditing

18
19