Layers of protection

Detection of corrosion and defects under a layer of protective coatings, rust and foulings to 8-10 mm in thickness. 

Layer of protection analysis (LOPA) is a simplified form of event tree analysis. Instead of analyzing all accident scenarios, LOPA selects a few specific scenarios as representative, or boundary, cases. LOPA uses order-of-magnitLide estimates, rather than specific data, for the frequency of initiating events and for the probability the various layers of protection will fail on demand. In many cases, the simplified results of a LOPA provide sufficient input for deciding whether additional protection is necessary to reduce the likelihood of a given accident type. LOPAs typically require only a small fraction of the effort required for detailed event tree or fault tree analysis. 

Frequency Phase 3 Use Branch Point Estimates to Develop a Ere-quency Estimate for the Accident Scenarios. The analysis team may choose to assign frequency values for initiating events and probability values for the branch points of the event trees without drawing fault tree models. These estimates are based on discussions with operating personnel, review of industrial equipment failure databases, and review of human reliability studies. This allows the team to provide initial estimates of scenario frequency and avoids the effort of the detailed analysis (Frequency Phase 4). In many cases, characterizing a few dominant accident scenarios in a layer of protection analysis will provide adequate frequency information. 

Using Layer of Protection Analysis for Estimating Chemical Process Risk (Final Draft), American Institute of Chemical Engineers, New York, NY, 2000. 

After the inherent hazards are reduced, layers of protection are frequently used to protect the receptors of the hazard—the public, the environment, workers, other processes, or the process itself (Figure 1.1). In the strictest sense, one could argue that the definition of inherently safer applies only to elimination or reduction of the hazard. In the broad sense, the strength of a layer of protection can be improved by features that are permanent and inseparable from that layer. Thus, layers of protection can be classified into three categories, listed in decreasing order of reliability passive, active, and procedural. A passive layer of protection can be described as inherently safer than an active... 

The layers of protection are expensive to build and maintain throughout the life of the process. Factors include initial capital expense, operating costs, safety training cost, maintenance cost, and diversion of scarce and valuable technical resources into maintenance and operation of the layers of protection. 

The hazard remains, and some combination of failures of the layers of protection may result in an accident. Since no layer of protection can be perfect, there is always some risk that an incident will occur. 

Figure Z.l. Tyffical layers of protection in a modem chemical plant (CCPS 1993b).

For these reasons, the inherently safer approach should be an essential aspect of any safety program. If the hazards can be eliminated or reduced, the extensive layers of protection to control those hazards will not be required. 

From Joe s and Mary s viewpoints, each may be correct. Joe s diverse interlock system is indeed inherently safer as a layer of protection than the alternative using identical sensors, but it is still part of a process which is inherently less safe than alternatives which... 

In many cases, the inherent safety advantages of one process are clear when compared with alternatives. One or more hazards may be significantly reduced, while others are unaffected or only marginally increased. For example, aqueous latex paints are clearly inherently safer than solvent based paints, although there are applications where the increased performance of solvent based paints justifies their use, with the appropriate layers of protection. 

An inherently safer process offers greater safety potential, often at a lower cost. However, selection of an inherently safer technology does not guarantee that the actual implementation of that technology will result in a safer operation than an alternate process which is inherently safer. The traditional strategy of providing layers of protection for an inherently more hazardous process can be quite effective, although the expenditure of resources to install and maintain the layers of protection... 

However, the benefits of air transportation, primarily speed, make it an attractive alternative for longer trips. These benefits have justified the expenditure of large amounts of money for providing extensive layers of protection to overcome the inherent hazards of air travel. The result is that air travel, while inherently more hazardous, is in fact safer than automobile travel for long trips. Similar situations can be expected to occur in the chemical process industry. 

Error recovery by the operators is only one of several layers of protection to prevent undesired consequences (see Figure 2.1). Process and equipment designs (discussed in previous chapters) that prevent undesired process excursions are inherently safer than designs that require operator intervention. Likewise, designs that enable the operators to intervene before an upset becomes serious are inherently safer than those that do not. 

The security system can be considered as layers of protection. Physical barriers and deterrents constitute not only the building stmcture itself, made up of walls, doors, windows, floor and a roof, but the yard around the building and probably a perimeter fence or wall. 

As with the case of mass, there are several approaches to metrics for this aspect. One can simply sum numbers and/or mass of chemicals possessing hazards in different areas for example, process safety, occupational exposure, or environmental hazard. Typically, most companies will use a banding approach for materials that allows a quick identification of the hazard category, and usually marries hazard with a suggested control approach for example, layers of protection, pressure relief valves, and so on. One is then able to rapidly identify issues and potential opportunities for elimination, substitution, or control. 

Meninges Three layers of protective membranes surrounding the brain. 

In general, the safety of a process relies on multiple layers of protection. The first layer of protection is the process design features. Subsequent layers include control systems, interlocks, safety shutdown systems, protective systems, alarms, and emergency response plans. Inherent safety is a part of all layers of protection however, it is especially directed toward process design features. The best approach to prevent accidents is to add process design features to prevent hazardous situations. An inherently safer plant is more tolerant of operator errors and abnormal conditions. 

Risk is the product of the probability of a release, thepjpbability of exposure, and the consequences of the exposure. Risk is usually described graphically, as shown in Figure 11-15. All companies decide their levels of acceptable risk and unacceptable risk. The actual risk of a process or plant is usually determined using quantitative risk analysis (QRA) or a layer of protection analysis (LOPA). Other methods are sometimes used however, ORA and LOPA are the methods that are most commonly used. In both methods the frequency of the release is determined using a combination of event trees, fault trees, or an appropriate adaptation. 

LOPA is a semi-quantitative tool for analyzing and assessing risk. This method includes simplified methods to characterize the consequences and estimate the frequencies. Various layers of protection are added to a process, for example, to lower the frequency of the undesired consequences. The protection layers may include inherently safer concepts the basic process control system safety instrumented functions passive devices, such as dikes or blast walls active devices, such as relief valves and human intervention. This concept of layers of protection is illustrated in Figure 11-16. The combined effects of the protection layers and the consequences are then compared against some risk tolerance criteria. 

Individual companies use different criteria to establish the boundary between acceptable and unacceptable risk. The criteria may include frequency of fatalities, frequency of fires, maximum frequency of a specific category of a consequence, and required number of independent layers of protection for a specific consequence category. 

CCPS, Layer of Protection Analysis Simplified Process Risk Assessment, D. A. Crowl, ed. (New York Center for Chemical Process Safety, AICHE, 2001) (in press). 

Figure 11-16 Layers of protection to lower the frequency of a specific accident scenario.

The primary purpose of LOPA is to determine whether there are sufficient layers of protection against a specific accident scenario. As illustrated in Figure 11-16, many types of protective layers are possible. Figure 11-16 does not include all possible layers of protection. A scenario may require one or many layers of protection, depending on the process complexity and potential severity of an accident. Note that for a given scenario only one layer must work successfully for the consequence to be prevented. Because no layer is perfectly effective, however, sufficient layers must be added to the process to reduce the risk to an acceptable level. 

Adjust the failure frequency to include the probabilities of failure on demand (PFDs) for each independent layer of protection. 

---