Catastrophic Failure scenarios

Khogeer (2005) developed an LP model for multiple refinery coordination. He developed different scenarios to experiment with the effect of catastrophic failure and different environmental regulation changes on the refineries performance. This work was developed using commercial planning software (Aspen PIMS). In his study, there was no model representation of the refineries systems or clear simultaneous representation of optimization objective functions. Such an approach deprives the study of its generalities and limits the scope to a narrow application. Furthermore, no process integration or capacity expansions were considered. 

Overpressure accidents can not only damage equipment but also cause injury or even death to plant personnel. In order to reduce the potential number of incidents or accidents, it is the job of the process engineer to analyse the process design and to determine the what can go wrong scenarios and either find a way to design out of them or provide protection against catastrophic failure in the event an accident does occur, that is, install an SRV and/or rupture disc. 

Scenarios— for each chenucal/mode of transport, three release sizes will be analyzed for a breach of the transportation container small hole (i.e., shearing of a valve coimection), tear (i.e., punctnre of the container), and catastrophic failure (i.e., large breach of the container), and are designated as small, medium, and large releases during the analysis... 

As architecturally resilient a system may be, redundancy at component level will not protect the system from catastrophic failure. For example a fire, earthquake or terrorist attack could quickly render an entire data centre useless. Whilst these scenarios are less frequent than component failure the stakes are higher in that recovery from these situations is challenging and the potential for permanent data loss a genuine possibility. A common solution to this is the use of a distributed architecture to achieve geographical diversity. 

Serious vessel collisions with bridges are extreme events associated with a great amount of uncertainty, especially with respect to the impact loads involved. As designing for the worst case scenario could be overly conservative and economically undesirable, a certain amount of risk must be considered as acceptable. The commonly accepted design objective is to minimize (in a cost-effective manner) the risk of catastrophic failure of a bridge component, and at the same time reduce the risk of vessel damage and environmental pollution. 

Scenario 4 is a different story. It is obvious that the likelihood is fairly high and the results are from critical to catastrophic. If we use the toxic cloud release example, this indicates that scenario 4 is a problem. It cannot stand as is the system needs to be modified in some fashion to lower the risk profile. If the failure scenario of that particular scenario is motor fails on, then the fix may be fairly easy. Various fail-safe controls could probably be put in place without much expense to mitigate the consequences. 

As such, all material functionalities are the result of a combination of appropriate material architecture and physico-chemical characteristics of its constituent elements. Small-scale damage affecting the chemical structure or architecture will lead to a decrease of the intended properties/functionality which can further lead to the replacement of the damaged area or, in the worst case scenario, to the catastrophic failure of the structure with consequent loss of time, material and money. 

For each scenario, possible release types for example pipe rupture, formation of holes in pressurized vessels, major or catastrophic failure etc. were identified which can cause in high loss of life in the surroundings. To ensure that the method remains workable, we propose that a select number of credible accident scenarios per industry, which may lead to potential offsite consequences, be considered. 

Procedures and plans supporting business continuity (Disaster Recovery Plans and Contingency Plans) must be specified, tested, and approved before the system is approved for use. Business Continuity Plans will normally be prepared for a business or an operational area rather than for individual computer systems. It is likely that the only way to verify the plan is to walk through a variety of disaster scenarios. Topics for consideration should include catastrophic hardware and software failures, fire/flood/lightning strikes, and security breaches. Alternative means of operation must be available in case of failure if critical data is required at short notice (e.g., in case of drug product recalls). Reference to verification of the Business Continuity Plans is appropriate during OQ/PQ. 

If the same scenario should occur in a field joint (and it could), then it is a jump ball as to the success or failure of the joint because the secondary O-ring cannot respond to the clevis opening rate and may not be capable of pressurization. The result would be a catastrophe of the highest order - loss of human life.It is my honest and very real fear that if we do not take immediate action to dedicate a team to solve... 

Failure The manifestation of a fault as it is executed. A failure is a deviation from the expected behavior, that is, some aspect of behavior that is different from that specified. This covers a large range of potential scenarios including, but by no means limited to, interface behavior, computational correctness, and timing performance, and may range from a simple erroneous calculation or output to a catastrophic outcome. 

The present case study deals with the risk assessment and management due a possible toxic release fiwm a chemical plant, which is expected to cause fatalities in a nearby population (Fig. 1). The accidental scenario considered in this study is the catastrophic rupture of a tank containing a gaseous toxic industrial chemical (TIC), caused by the failure of the pressure control system of the tank. After the rupture, a toxic cloud is formed instantly and dragged by the wind over the local population. 

To quantify the effect of a measure on the failure frequency it is necessary to determine the scenarios (see Table 1) for which the measure is relevant and to determine the reduction factor of the failure frequency. The reduction factor depends on the relative contribution of a failure cause to the failure frequency. For example, if overfilling is the dominant failure cause for the scenario Catastrophic rupture - 10 minutes , implementation o f corro sion mitigating measure s will have a very limited effect on the failure frequency of this scenario. Therefore, the standard failure frequency of each scenario has to be proportioned to the failure causes. 

OverfiUing is not a relevant base cause for the scenario Catastrophic rupture - Instantaneous . Therefore the overfill protection will not lead to a failure frequency reduction and the standard failure frequency of 5 x 10 per year should be used ... 

This can be illustrated by the distribution of selected incidents over the standard scenarios Catastrophic rupture - Instantaneous , Catastrophic rupture -10 minutes and Small leak - 10 mm hole . The scenarios show a ratio 1 0,7 0,3 respectively, whereas the standard failure frequencies show a ratio 1 1 20. Possible explanations for this discrepancy are that either the standard failure frequency overestimates the occurrence of small leaks, or small leaks are underreported in the databases. Since small leaks of atmospheric liquids pose little hazard to third party risk, it can be expected that small leaks are underreported. Especially the MARS database has a threshold for reporting. 

Imagine that you are responsible for a chemical process unit. The pressure in a chemical reactor begins to increase. You are concerned about material failure and explosion. What do you do For a case such as this with potential catastrophic consequences, it may be necessary to shut the process down. However, process shutdown and start-up are very costly, and if a safe alternative were available, you would certainly want to consider it as an option. In another scenario, what would you do if it had been observed that the purity of product from your unit had been decreasing continuously for several days, and customers had begun to complain of poor product quality and have threatened to cancel lucrative contracts ... 

LWR tests-to-failure had been performed to evaluate accident scenarios involving LOCA events such as occurred in the Three Mile Island incident. The power burst tests in a 20 MWt PWR have created fuel failures and defined the initiating conditions. The LOCA tests with a 50 MWt PWR have demonstrated recovery from catastrophic major feedwater and steam line breaks without fuel damage. 

The data collected for the safety criticality estimation is based on expert judgement and is shown in Table 8.4. The failure was evaluated for its safety and operational criticality for the four different categories on a scale of 0 to 10. The estimation of the safety severity parameter, is assumed for the worst case scenario. It is also assumed that if the failure does not lead to a catastrophic breakdown, the operational safety severity () will be minimal. 

This upset initiates a runaway reaction that can catastrophically rupture the reactor. The impact of this event was judged to be extensive, which, as discussed in Table 6 Note 1, leads to a tolerable frequency of 10 /year for a single scenario. Several failures in the control system could cause this upset, with operating experience indicating that this type of upset occurs about once every 10 years. Protection per Table 5 was the Shortstop addition, but the runaway reaction may be too fast for the operator to respond to an alarm. This protection layer is not included for risk reduction. The area is normally occupied, so it was assumed that personnel could be impacted by the event. The pressure safety valves (PSVs) are only estimated to be 90% effective, since plugging is a common problem in this service. Since the PSVs share a common relief line, they are conservatively considered to be a single Independent Protection Layer. This led to an intermediate event likelihood of a 10 per year. Per the conservative assumptions used in this example, only the PSVs qualified as an IPL. The PHA team reviewed all the process safety risk issues and decided that a SIF was appropriate. As shown in Table 7, this requires a SIL 3 SIF. 

---