LOPA question 1

[Tom_H]

There has been some internal debate following a LOPA that is being used to perform SIL allocation. One scenario in the LOPA is overpressuring of a tank during filling operation. Filling operations take place about 10 times per year.

One initating cause for overpressure in the tank during filling is failure of BPCS pressure control loop. This has been given a standard frequency from literature (CCPS) of 0.1 as is commonly used.

What has then been done by the person that performed the "LOPA" is to simply say:

0.1 x 10 times per year = 1, so frequency of the initiating cause is 1. And then continued listing possible IPL:s that for various reasons leads to the need for a SIF.

Some questions arise:

1. Is this mathematically correct? Is this not multiplying two frequencies - which I don't think you can do?
2. Is 10/1=10 (ten times per year filling operation) really even a frequency (relative frequency), is is not more of an absolute frequency, i.e. a count?
3. In LOPA, should the initiating event not always be a failure of some sort, and then things like filling operations are handled under time at risk/enabling conditions?
4. Even if the filling operation is handled under time at risk/enabling condition, should it then be used as "10/1", or as a fraction of time during a year? I.e. say it takes 8 hours to fill, should it then not instead be 8x10/8760 = 0.009 ?

Thanks in advance!

 

[EmmanuelTop]

If the risk is proportional to the number of times the operation is performed, "time at risk" is not appropriate and cannot be used as frequency modifier for the initiating event. The initiating event which is a 'per opportunity' failure precludes the use of "time at risk".

For example, the risk of a tank overflow which is filled by a batch operation is proportional to the number of fills, not to the duration of each fill. The more often you fill a tank, the higher the risk is, because it is based on the opportunity and not on a random factor unrelated to the filling operation.

Other than controls failure, possibly human error (wrong valve opened?) and some other causes may initiate the same scenarios so make sure you have them all covered in the calculation of the SIF for overfill protection.

Dejan IVANOVIC
Process Engineer, MSChE

 

[Tom_H]

Thank you, it makes sense when you word it that way and of course relates more to how probabilities work than blindly following a LOPA procedure. I.e. that the risk of course would be proportional to the number of operations and not time.

Still, the CCPS LOPA report does state that it is always a failure that should be the initiating cause. Even though it perhaps does not matter calculation wise, how would you formally handle a factor such as "number of fills per year" when not as time at risk?

 

[Jobst]

I would contrast this with the case where a BPCS loop is managing something 100% of the time during the year: the probability of that failing, per CCPS, is 0.1/year. Now, what is different about the loop in question, that it is only operated for a few hours (or tens of hours) in a year, but has a higher likelihood of failing?

One should take into account all causes of the loop failing, so if it's something that has to be manually initiated, perhaps there's a higher probability of the operator failing to do that, or doing it incorrectly. In that case, I would argue that BPCS loop failure is not the proper initiating event. Rather the operator error is the underlying cause. Which I think CCPS treats differently, in a manner similar to the "chance to fail per action * actions taken per year" method you're talking about. There's different figures for routine procedures, performed frequently, under no time pressure, vs. non-routine, infrequent procedures, under time pressure, etc.