Before I begin, nothing I am going to say in this article is required by OSHA or EPA; however, keep in mind that OSHA and EPA process safety requirements are the BOTTOM OF THE BARREL when it comes to true process safety. So with that said, let’s discuss PHA scenario likelihoods. Regardless of methodology used, at some point during a PHA someone will through out the notion “that will never happen!” For some strange reason I find the sceanrios that the facility believes would never happen, one that has a high probability of occuring. Here’s an example and some data to consider.
Did you know that the chemical/refining and nuclear industry has done extensive research and established some baseline probabilities for “initiating events”, as well as establishing a level of “credit” we can take for our safeguards in place to PREVENT, PROTECT, and MITIGATE the scenarios? Below is a list of some very basic data, but it may be an eye-opening bit of data.
Initiating Event Example Values /yr
Valves, etc.
Check valve fails to check fully 1×100
Check valve sticks shut 1×10-2
Check valve leaks internally (severe) 1×10-5
Gasket or packing blows out 1×10-2
Regulator fails 1×10-1
Safety valve opens or leaks through badly 1×10-2
Spurious operation of motor or pneumatic valves – all causes 1×10-1
Vessels and Tanks
Pressure vessel fails catastrophically 1×10-6
Atmospheric tank failure 1×10-3
Process vessel BLEVE 1×10-6
Sphere BLEVE 1×10-4
Small orifice (≤ 2”) vessel release 1×10-3
Utility
Cooling water failure 1×10-1
Power failure 1×100
Instrument air failure 1×10-1
Nitrogen (or inerting) system failure 1×10-1
Piping and Hoses
Loss of containment (flange leak or pump seal leak) 1×100
Flex hose leak – minor – for small hoses 1×100
Flex hose rupture or large leak – for small hoses 1×10-1
Unloading or loading hose failure – for large hoses 1×10-1
Pipe fails (large release) for ≤ 6″ pipe 1×10-5
Pipe fails (large release) for > 6″ pipe 1×10-6
Piping leak – minor – per each 50 ft. 1×10-3
Piping rupture or large leak – per each 50 ft. 1×10-5
Maintenance Error
External impact by vehicle (assuming guards are in place) 1×10-2
Crane drops load 1×10-3 / # of lifts/yr.
LOTO (Lock-Out Tag-Out) procedure not followed 1×10-3 / opportunity
Operator Error
Operator error – no stress (routine operations) 1×10-1
Operator error – stress (alarms, startup, shutdown, etc.) 1×100
Machinery Failure
Pump bowl failure (varies with material) 1×10-3
Pump seal fails 1×10-1
Pumps and other rotating equipment with redundancy (loss of flow) 1×10-1
Turbine-driven compressor stops 1×100
Cooling fan or fin-fan stops 1×10-1
Motor-driven pump or compressor stops 1×10-1
Overspeed of compressor or turbine with casing breach 1×10-3
Instrumentation Failure
BPCS loop fails 1×10-1
External Events
Lightning hit 1×10-3
Large external fire (all causes) 1×10-2
Small external fire (all causes) 1×10-1
Vapor cloud explosion 1×10-3
Let’s put some perspective to these numbers:
Now that we have established our frequency, we then look to our “safe guards” that are in place to either PREVENT the scenario from initiating, PROTECT assets once the scenario occurs, and/or MITIGATE the consequences. But how much “credit” should we claim for these “safe guards”? Well we have an aswer for that question. Below are some established safeguards and the “credit” we can take for each one. These are called “Independent Protection Layers” and in order to take credit for each one, we have to ensure we have adequate documentation, training, testing procedures, design basis, and inspection/maintenance procedures for each layer we claim.
IPL Credits (PFD)
Passive Protection
Secondary containment (dikes) or other passive devices 1
Underground drainage system that reduces the widespread spill of a tank overfill/rupture/leak/etc. 2
Open snorkel vent with no valve that prevents overpressure 2
Equipment-specific fireproofing that provides adequate time for depressurizing/firefighting/etc. 2
Blast walls or bunkers that confine explosions and protect equipment/buildings/etc. 3
Vessel MAWP of ≥2x maximum credible internal or external pressures 2
Flame/detonation arrestors ONLY if properly designed, installed and maintained 2
Active Protection
Automatic deluge or active sprinkler systems (if adequately designed) 2
Automatic vapor depressuring system (can’t be overridden by BPCS) 2
Remotely operated emergency isolation valve(s) 1
Isolation valve designed to fail-safe (can’t be overridden by BPCS) 2
Excess flow valve 2
Spring-loaded pressure relief valve 2
Rupture disc (if separate from relief valve) 2
Basic Process Control System can be credited as an IPL ONLY if not part of the initiating event 1
SIL 1 Trip (independent sensor, single logic processor, single final element) 2
SIL 2 Trip (dual sensors, dual logic processors, dual final elements) 3
SIL 3 Trip (triple sensors, triple logic processors, triple final elements) 4
Human Response
Operator responds to alarms (stress) 1
Operator routine response (trained, no stress, normal operations) 2
Human action with ≤10 minute response needed. Simple, well-documented action with clear
and reliable indications that action is required 1
Human action with between 10 and 30-minute response needed. Simple, well-documented
action with clear and reliable indications that action is required 2