lable at ScienceDirect

Journal of Loss Prevention in the Process Industries 24 (2011) 879e885

Contents lists avai

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier .com/locate/ j lp

Improving PHA/LOPA by consistent consequence severity estimation

Angela Summers*, William Vogtmann, Steven SmolenSIS-TECH Solutions, 12621 Featherwood Dr, Suite 120 Houston, TX 77034, USA

a r t i c l e i n f o

Article history:Received 25 January 2011Received in revised form14 June 2011Accepted 14 June 2011

Keywords:LOPARisk analysisConsequenceQuantitative

* Corresponding author. Tel.: þ1 2819228324; fax:E-mail address: asummers@sis-tech.com (A. Summ

0950-4230/$ e see front matter � 2011 Elsevier Ltd.doi:10.1016/j.jlp.2011.06.022

a b s t r a c t

Most risk analysis methods rely on a qualitative judgment of consequence severity, regardless of theanalysis rigor applied to the estimation of hazardous event frequency. Since the risk analysis is depen-dent on the estimated frequency and consequence severity of the hazardous event, the error associatedwith the consequence severity estimate directly impacts the estimated risk and ultimately the riskreduction requirements. Overstatement of the consequence severity creates excessive risk reductionrequirements. Understatement results in inadequate risk reduction.

Consistency in the consequence severity estimate can be substantially improved by implementingconsequence estimation tools that assist PHA/LOPA team members in understanding the flammability,explosivity, or toxicity of process chemical releases. This paper provides justification for developing semi-quantitative look-up tables to support the team assessment of consequence severity. Just as thefrequency and risk reduction tables have greatly improved consistency in the estimate of the hazardousevent frequency, consequence severity tables can significantly increase confidence in the severityestimate.

� 2011 Elsevier Ltd. All rights reserved.

1. Introduction

Various types of process hazards analyses (PHA) are now inwidespread use throughout the process industry (CCPS/AIChE,2008). These analyses evaluate process deviations that potentiallylead to hazardous events and the safeguards that are implementedto reduce the likelihood of each event. Many PHAs incorporate riskanalysis to determine the residual risk of each identified event inorder to determine if additional safeguards are needed. This isaccomplished by qualitatively estimating the likelihood of theevent given its causes and safeguards and the magnitude of theconsequence severity without safeguards. The PHA process can besupplemented with Layers of Protection Analysis (LOPA) to providean order of magnitude estimate of the hazardous event frequencyby assessing the frequency of the initiating events that lead tothe hazardous event and the probability that the safeguards fail(CCPS/AIChE, 2001).

One of the authors has often stated “A big risk is not addressedby a big list: it is addressed with the right list of independentprotection layers”. A big risk generally involves an event judged tohave a consequence severity of a potential significant injury orfatality. PHA teams often deal with big risks by ensuring that there

þ1 2819224362.ers).

All rights reserved.

is a big list of safeguards, thus making the event seem much lesslikely when the team is asked to qualitatively assess the potentialhazardous event likelihood considering the causes and safeguards.In most PHAs, safeguards are recommended if they reduce theevent likelihood by a little or a lot. Yet, the expectation is thateverything on the list is safety-related and is managed with thesame degree of rigor. Instead of a big safeguard list, an owner/operator needs to identify safeguards that have been demonstratedto provide risk reduction.

LOPA begins with an estimate of the likelihood of root causes (orinitiating causes) and enabling conditions, which result in processdeviations (or initiating events). In basic LOPA, the likelihood of theinitiating event is estimated on an order of magnitude basis. Someadvanced LOPA techniques use detailed fault trees and field dataanalysis to support the likelihood estimate. Regardless of thefrequency estimate precision, if the risk of the initiating event(frequency and consequence) is higher than the company riskcriteria, the team identifies independent protection layers (IPL) thatprovide sufficient risk reduction to meet the risk criteria.

IPL are typically a subset of the safeguards listed in the PHA. Aseach candidate safeguard is considered, the LOPA team determineswhether the safeguard meets seven core attributes that arerequired for it to be considered IPL, namely, independence, integ-rity, reliability, functionality, access security, management ofchange, and auditability. In some applications, IPL are dictated byindustrial practices to ensure that the equipment is properly

A. Summers et al. / Journal of Loss Prevention in the Process Industries 24 (2011) 879e885880

protected based on a particular sector’s understanding of thepotential for hazardous events. In all cases, in order to take creditfor an IPL in LOPA, it must be assured that it can provide the claimedrisk reduction based on an analysis of its design and management.

The characterization of the initiating event frequencies and IPLrisk reduction in order of magnitude terms allows teams with littlemathematical inclination to estimate the hazardous eventfrequency based on information and data that correspond to keyperformance indicators (CCPS/AIChE, 2001; CCPS/AIChE, 2010). Inmost cases, the team is provided with look-up tables of typicalinitiating cause frequencies and IPL risk reduction values that canbe adjusted based on specific site experience, so the estimatedhazardous event frequency is generally very consistent from teamto team. As advanced LOPA procedures make more precise esti-mates of the frequency of the events and probability of IPL failure,the hazardous event frequency estimate becomes more quantita-tive, but the method remains inherently semi-quantitative due tothe qualitative estimation of consequence severity.

The logical next step in improving LOPA is to introduce guidancefor estimating the consequence severity using an order of magni-tude approach. The following discussion presents the authors’proposal for semi-quantitative selection of consequence severityassociated with flammable releases based on the zone of over-pressure generated on ignition of the material. Simple look-uptables are presented that rely on equipment design specificationsand process operating conditions e information that shouldalready be maintained by the site and provided to the team thatis conducting the analysis. Dispersion modeling based on theEPA’s worst-case release scenario assumptions (EnvironmentalProtection Agency (EPA), 1996) as well as the guidance docu-mented in the EPA/NOAA dispersion modeling tool (EnvironmentalProtection Agency (EPA), 2007) was used to correlate estimatedrelease rates to “zones of damaging overpressure” generated whenthe released material ignited. Then, these zones were tied to theconsequence severity rankings that typically support risk analysesduring the PHA and LOPA. The look-up tables have been demon-strated to yield a consistent basis for estimating the consequenceseverity, leading to greater consistency in the risk estimateregardless of the team experience with harmful events.

2. LOPA is a great tool!

LOPA is an excellent tool for assessing a wide variety of processhazard scenarios and then crediting or applying protection layers ofappropriately robust design. LOPA, as a semi-quantitative analysis,allows for efficient evaluation of process hazards by a multi-

Table 1Qualitative consequence severity ranking.

Ranking Safety Environmental

5 Multiple fatalities across a facility and/orInjuries or fatalities to the public

Catastrophic off-sitewith long-term cont

4 Hospitalization of three or more personnel(e.g., serious burns, broken bones) and/orone or more fatalities within a unit or localarea and/or Injuries to the public

Significant off-site en(e.g., substantial harprolonged containm

3 Hospitalization injury (e.g., serious burns,broken bones) and/or multiple lost work dayinjuries and/or Injury to the public

On-site release requclean-up and/or off-environmental dama

2 Lost work day injury and/or recordable injuries(e.g., skin rashes, cuts, burns) and/or minorimpact to public

On-site release requclean-up by emergenoff-site release (e.g.,environmental dama

1 Recordable injury and/or no impactto the public

On-site release requclean-up by on-site

disciplined team of representatives that are experienced with theequipment under study. The results are based on a better estimateof the hazardous event frequency and therefore provide strongjustification for recommending safety functions or layers.

LOPA supports performance-based process safety because it tiesvarious quality assurance metrics or key performance indicators tothe hazardous event frequency. As owner/operators track thechallenges on their IPLs and failures of their IPLs, LOPA providesa means to compare order of magnitude estimates of historicalperformance to industry-benchmarked values.

Fortunately, process safety incidents are infrequent in theprocess industry, so most teams have little experience withhazardous events. On the other hand, teams do have experiencewith the root causes (or initiating causes), process deviations (orinitiating events), and failed IPLs. Thus, when the hazardous eventis broken down into the initiating causes and IPLs, the eventfrequency can be understood by all disciplines and those disciplinesthat impact the event frequency can better understand their role inhazardous event propagation. Done right, it gives the organizationa firm and consistent basis for investment in protective systems.

3. LOPA is inconsistent!

As organizations progress with LOPA, invariably the results forsimilar equipment and process units are compared and questionsare asked about the differences. It is not unusual to see variation inthe risk estimate for similar hazardous events in nearly identicalprocess units. Since most LOPA procedures have well-definedmethods for estimating the hazardous event frequency, theinconsistency in the risk estimate is often due to variation in theestimated consequence severity.

Most LOPA methods rely on a qualitative estimate of theconsequence severity. Table 1 provides an example of typicalconsequence severity descriptions. These descriptions are essen-tially statements of harm that the team is expected to judge basedon the propagation of the process deviation into a hazardous eventand ultimately to harm. While the team members may haveexperience in process deviations, hopefully, they have little expe-rience with hazardous events and the resulting harm.

The severity estimate is often bounded with qualitative guid-ance that the team should estimate the “worst-case consequence”or “worst credible consequence”. For example, the worst crediblescenario is “the most severe incident of all identified outcomes andtheir consequences that is considered plausible or reasonablybelievable” (CCPS/AIChE, 2007). The interpretation of these termsand their definitions has proven to be highly variable. The

Asset

environmental damageainment and clean-up

Expectant loss greater than $10,000,000 and/orsubstantial damage to buildings located off-site

vironmental damagem to wildlife) withent and clean-up

Expectant loss between $1,000,000 and $10,000,000and/or extended downtime with significant impactto the facility operation and/or minor damage(e.g., broken windows) to buildings located off-site

iring containment andsite release causingge with quick clean-up

Expectant loss between $100,000 And $1,000,000and/or downtime of several days severely impactingthe facility operation

iring containment andcy personnel and/orodor) but noge

Expectant loss between $10,000 and $100,000and/or downtime of more than day causingimpact to facility operation and/or reportablequantity event

iring containment andpersonnel.

Expectant loss of less than $10,000 and/ordowntime of less than a day with minor impactto the facility operation

Table 2Example risk matrix .

A. Summers et al. / Journal of Loss Prevention in the Process Industries 24 (2011) 879e885 881

perceived error in this severity estimate is one of the chief criti-cisms of PHA and LOPA. And, unfortunately, perception often drivesinvestment, so if it is perceived that the team was excessivelyconservative in the consequence severity estimate, it is easier formanagement to reject PHA and LOPA recommendations asunwarranted.

There are many legitimate reasons for variation in the conse-quence severity estimate across an organization, including differ-ences in the specific process quantities, layout, location, equipmentpressure ratings, etc. These differences are recognized by therespective teams and result in different consequence severityrankings. In many cases, these specific differences are not fullydescribed in the PHA or LOPA documentation, making it difficult forpeople who were not part of the team to understand why thedifferences exist. Variation in results is not necessarily an indicatorthat teams are performing the analysis incorrectly. Indeed it oftenreflects why PHA and LOPA are performed on specific equipmentand process units, and why these studies are revalidated periodi-cally to capture lessons learned in operating and maintaining theequipment.

A significant amount of variation is introduced due toperceptual differences of the hazardous situation created by thehazardous event. Bias may also be introduced into teams by thepresence of risk-taking or risk-adverse people. Direct experiencewith the hazardous event is a strong influence on the estimate.For example, where a site or team member has experienced a fireand no one was hurt, the assumed outcome for any fire maybecome “no one gets hurt”. If there is experience where peoplewere hurt or killed by the fire, even due to extremely unusualconditions, all events resulting in a potential fire may be regardedas a fatality event. While no one should take any fire lightly, theconcept of risk analysis certainly incorporates the idea that largefires should receive more attention and effort in prevention thansmall ones, other factors being equal.

These qualitative biases may be great enough to push theseverity estimate to a more or less conservative result than isappropriate. Overstatement of severity creates excessive riskreduction requirements and costs. Understatement results ininadequate risk reduction and a higher potential for loss events.Providing the team with a semi-quantitative basis for the severityassessment can significantly reduce variability.

4. Conditional modifiers can (not) fix it!

Basic LOPA analyzes the risk for each hazardous event resultingfrom one or more process deviations. Basic LOPA focuses the riskanalysis on preventing hazardous events, which reduces thepotential for harm and event escalation. This agrees with OSHA 29CFR 1910.119 (OSHA, 1992), which is dedicated to not just “mini-mizing the consequences of catastrophic releases of toxic, reactive,flammable, or explosive chemicals” but also to “preventing” suchreleases. The typical LOPA risk criteria are that the maximumhazardous event frequency should not exceed 1 � 10�4/yr forevents potentially leading for a worker fatality or 1 � 10�5/yr forevents potentially leading to a public fatality (CCPS/AIChE, 2009).The overall frequency of all deviations leading to the samehazardous event should achieve these risk criteria. Many riskmatrices have similar risk criteria built into the relationshipbetween frequency and consequence severity as illustrated inTable 2 (CCPS/AIChE, 2007).

Some owner/operators use LOPA to support risk criteria basedon the harmful event frequency. Some regulatory authoritiesrequire that the maximum individual risk or societal risk bedetermined and reported as part of permitting or safety cases. Oncethe hazardous event frequency is known, the team assesses site-

specific conditions (e.g., probability of ignition and probability ofoccupancy) to determine the harmful event frequency. The prob-ability values assumed for conditional modifiers whether used inLOPA or QRA (quantitative risk analysis) should be justified throughapplication-specific analysis. Typical risk criteria are a maximumindividual risk of 1 � 10�5/yr for a worker or 1 � 10�6/yr for thepublic (CCPS/AIChE, 2009). Assessment against these risk criteriarequires that the overall frequency of all deviations leading to thesame hazardous event be determined.

Conditional modifiers are often proposed as a means to dealwith overstated consequence severity. Since the conditionalmodifiers reduce the frequency, the “risk” is likewise lowered.However, the use of conditional modifiers also depends on the basisfor the risk analysis. It is not appropriate to use conditional modi-fiers if the risk criteria are based on the hazardous event frequency(e.g., loss of containment) rather than on direct harm frequency(e.g., fatality). Regardless of the frequency basis, the use of condi-tional modifiers does not address or minimize the error associatedwith the consequence severity estimate. It does provide a means torationalize that the likelihood of such harm is lower; however, theconsequence is still overstated.

5. Templates can (not) fix it

Some owner/operators have tried to get consistency in the LOPAby providing teams with standard LOPA scenarios for specificprocess units. This is especially attractive in organizations withvirtually identical units or highly standardized installations inmultiple locations. These template scenarios can be very useful ingiving specific guidance to a team. In many cases, the templates listIPLs that are considered good engineering practice, so teams haveguidance on not only the risk but also the means for risk reduction.The use of templates does not restrict the team’s ability to analyzethe risk of a specific installation, since the team is still expected toidentify significant differences between their installation and thetemplate and to make adjustments to the template as necessary.However, such templates have proven to be difficult to develop,approve, and implement, predominantly because consensus on anorganization-wide consequence severity ranking is difficult toachieve.

6. Developing consequence severity guidance

The authors developed a set of consequence severity look-uptables to support PHA and LOPA using dispersion modeling.The Keep It Simple and Straightforward (KISS) principle wasapplied to the modeling effort, since the model was intended to be

A. Summers et al. / Journal of Loss Prevention in the Process Industries 24 (2011) 879e885882

conservative and support order of magnitude consequence severityestimation. It was also desirable to have tables that based theseverity on something that the team could assess themselves usinginformation typically provided to the PHA or LOPA team. The resultsalso needed to be presented in a format that made the tool practicalfor the team to use. Ultimately, a set of look-up tables weredeveloped which yielded a severity ranking or range of severities,depending on the equipment type and release conditions.

Since many events that pose significant risk involve the releaseof flammable materials, the first look-up tables addressed flam-mable hydrocarbon releases. Alkanes and alkenes, includingC1eC10, are widely used in the process industry, so these wereselected for modeling using ALOHA�. It was determined that thisset of hydrocarbons yielded relatively similar zones of damagingoverpressure for a given hole diameter and release rate. Conse-quently, the tables were simplified by treating these compounds asa single class of hydrocarbons.

Guidance was also needed to relate the initiating event condi-tions to an expected hole diameter or damage estimate. This led tothe development of tables relating pump size (shaft size or HP) to anequivalent seal hole diameter, % overpressure to an equivalent holediameter, or firebox type to equivalent damage. This paper will onlypresent the pump size correlations for the loss of a mechanical seal.

6.1. Disclaimer

This guidance is intended to produce consistent results forsimilar hazardous events, but no severity estimate is a perfectforecast of actual events. Where plant conditions are significantlydifferent from the assumptions, additional studies and/or conse-quence modeling should be considered. The PHA or LOPA team isadvised to reach a consensus on consequence severity, consideringsite-specific factors, the consequence severity tables, specificmodeling results, and other available information. Ultimately, theguidance is intended to release teams from concern that they arenot treating safety seriously if they don’t consider all releases ashigh severity and the opposite concern that they are being tooconservative about the process if they predict that many scenariospose severe consequences.

Table 3Estimated equivalent hole diameter for single mechanical seal failure.

A. Shaft size (inches) vs equivalent hole diameter (inches)Shaft 0.5 1 2 3 4 6 8Hole 1/8 3/16 1/4 3/8 1/2 5/8 3/4

B. Horsepower vs equivalent hole diameter (inches)HP <5 5e10 10e50 50e150 150e300 300e600 >600Hole 1/8 3/16 1/4 3/8 1/2 5/8 3/4þ

Note: The equivalent hole diameter estimate assumes that the carbon faces andtheir support within the seals provide no sealing. The remaining leak path is limitedby the clearance between the shaft and the seal housing/support. An annular radiusof 0.01 was used for small shaft sizes (up to 3 inch) and 0.016 was used for largershafts.Note: The equivalent hole diameter estimate was developed by reviewing theoutput shaft size of typical industrial motors rated for various HP. The reviewindicated that the pumps could be grouped for simplification of the look-up table.The stated equivalent hole diameter is based on the shaft sizes for the upperboundary of each group.

6.2. Dispersion modeling

Keeping everything simple was probably the highest hurdle toovercome. It was easy to become overwhelmed with the differentmodeling tools and the large number of parameters that could bespecified. Fortunately, analysis paralysis was ended by acceptingthe worst-case release scenario assumptions used to support theEPA Risk Management Plan (Environmental Protection Agency(EPA), 1996) as well as the guidance documented in the EPA/NOAA dispersion modeling tool (Environmental Protection Agency(EPA), 2007). The simplifying assumptions made were:

� Weather/topographical conditionsB Wind: 3 knots from South at 3 mB Ground roughness: open countryB Air temperature: 95 �FB Stability class: B e software determined

NOTE: ALOHA provides the stability class based on informationabout the time of day, wind speed, and cloud cover.

B No inversion heightB Cloud cover: 5 tenthsB Relative humidity: 50%

� CongestionB Congested e not open space, difficult to walk through

The dispersion modeling software chosen was ALOHA whichwas developed by the EPA’s Office of Emergency Management andNOAA’s Emergency Response Division (Environmental ProtectionAgency (EPA), 2007). ALOHA is an atmospheric dispersion modelused for evaluating releases of hazardous chemicals, including toxicgas clouds, fires, and explosions. Using input about the releaseALOHA generates a threat zone estimate. A threat zone is the areawhere a hazard (such as toxicity, flammability, thermal radiation, ordamaging overpressure) is predicted to exceed a user-specifiedlevel of concern.

The major reasons for selecting this software were that it was:

� Developed by EPA/NOAA for use in a site’s Risk ManagementPlan (RMP) and Emergency Response Plans (ERP)

� Familiar to Local Emergency Planning Committees (LEPC) sincemany companies used the software for their rmp case(s)

� User friendlyB Often provided suggested/recommended values for

parameters making it more suitable for the what-if type ofmodeling required

B Includes guidance on severity based threat zoneB Availability of large database of hazardous materials

� Available at no cost to the user as well as the general public(LEPC)

6.3. Covered chemicals

The consequence severity look-up table addresses the hazardsassociated with the release of flammable liquids and vapors in therange of C1eC10 (alkanes and alkenes). The consequence severityof the hazardous event was defined by the zone of damagingoverpressure generated when the flammable hydrocarbons werereleased from a defined hole diameter at a specified rate. Thismodel did not consider the potential for pool fires, flash fire, or jetfires. It also did not consider potential secondary effects resultingfrom overpressure or fire exposure, which could impactsurrounding process equipment and cause additional failures.

6.4. Hole diameter estimate

Hole diameter look-up tables were developed for vessel andpiping overpressure and seal leaks. This paper only presents theresults for estimating the hole diameter for single mechanical seals.As shown in Table 3, the hole diameter can be estimated based on

Table 4Liquid release rate (lb/min) as a function of pressure and hole diameter.

Liquid release rate rate (lb/min)

Pressure vs. hole diameter

Psig/inches 1/16 1/8 1/4 1/2 1 1.5 2 3 4 6

10 2 8 31 120 500 1100 2000 4500 7900 1790050 4 17 69 280 1100 2500 4400 9980 17700 X100 6 25 98 390 1600 3500 6300 14100 X X150 8 30 120 480 1900 4300 7700 X X X300 11 42 170 680 2700 6100 10900 X X X500 14 55 220 880 3500 7900 X X X X1000 19 77 310 1200 5000 11200 X X X X2000 27 110 440 1800 7000 X X X X X6000 47 190 760 3000 12100 X X X X X10000 61 250 980 3900 X X X X X X30000 110 420 1700 6800 X X X X X X50000 137 550 2200 8800 X X X X X X

“X” ¼ no details are provided, since the release is equivalent to category 5.

A. Summers et al. / Journal of Loss Prevention in the Process Industries 24 (2011) 879e885 883

the pump shaft size at the seal or on horsepower. The shaft size(Table 3A) may be a more accurate predictor of hole diameter, butexperience indicates that horsepower (Table 3B) is more commonlyavailable to the team. The information may be included on unitP&IDs or in mechanical data sheets.

6.5. Release rate estimate

For the flammable hydrocarbons, separate release rate tableswere developed for liquid and vapor releases. The team determineswhether the release will be liquid or vapor considering processconditions when the hazardous event occurs. Table 4 is for liquidreleases through holes of 1/16 inch to 6 inches in diameter atpressures of 10e50,000 psig. The presence of an “X” in the tableindicates a release that exceeds the threshold of 10,000 lbs/min,which was determined to correlate with a category 5 consequenceseverity.

Fig. 1.

6.6. Zones of damaging overpressure

Modeling of the selected hydrocarbons under the conditionsstated in Section 6.2 showed that the majority of the releasesreached steady state with clearly identified zones of hazardousconditions within 5 min, which is consistent with the EPA’s RMPguidance to use an endpoint of 10 min for scenario modeling. Fig. 1is a screen capture showing a typical output from ALOHA�

(Environmental Protection Agency (EPA), 2007). The ALOHA outputdepicts three predefined “zones of damaging overpressure”. Theyellow zone (outer ellipse) is an overpressure greater than 1 psi.This pressure typically causes minor damage to structures andminimal direct harm to humans. The ALOHA output includesa reference to shattered glass to indicate that 1 psi is a minorimpact. The orange zone (inner ellipse) is an overpressure greaterthan 3.5 psi. This pressure typically causes structural damage tobuildings and direct harm to humans. The ALOHA output includes

Table 5Potential safety consequence severity. Release of flammable gas or flashing liquidwithin an operating unit.

Leak rate Impact area Severity

Unit area

10,000 lb/min And over >1.00a 51000 lb/min 10,000 lb/min 0.66->1.00a 4100 lb/min 1000 lb/min 0.33e0.66 310 lb/min 100 lb/min 0.16e0.33 20 lb/min 10 lb/min <0.16 1

a Upper bound is 3.5 psi over 3 times unit area.

Table 6(from Table 3B with the team choice highlighted).

Horsepower vs Equivalent Hole Diameter

HP <5 5e10 10e50 50e150 150e300 300e600 >600Hole (inches) 1/8 3/16 1/4 3/8 1/2 5/8 3/4þ

Table 8(same as Table 5 with the team choice highlighted).

A. Summers et al. / Journal of Loss Prevention in the Process Industries 24 (2011) 879e885884

a reference to serious injury to indicate that 3.5 psi representsa point where injuries are likely due to the overpressure, but thisreference does not consider the potential for flying debris orstructural damage. There is a potential for a red zone to appear onthe graphic when there is an overpressure greater than 8.0 psi. Thispressure is known to cause significant structural damage to struc-tures and buildings as well as direct harm to human. The ALOHAoutput includes a reference to destruction of buildings to indicatethe severity of this overpressure.

Examination of the results obtained from the modeling of thehydrocarbon class (consisting of C1e10 alkanes and alkenes)identified no red zones (8 psi). This agreeswith other data reviewedprior to modeling, which suggested that it was unlikely that typicalhydrocarbon releases within process units would achieve thisdegree of overpressure.

The zone represented by the 3.5 psi overpressure seemed likea conservative selection for determining the potential areaimpacted by the overpressure, since this overpressure was judgedto be significant enough to cause direct injury and to result in flyingdebris. It was also felt to be more intuitive for the correlation sincethe qualitative consequence severity descriptions include thepotential for injury and fatality. Selecting a higher overpressure forthe correlation would have resulted in a smaller impact area, buta more severe outcome within the area.

To correlate overpressure damage to differing levels of conse-quence severity, it was necessary to establish a relationshipbetween zone of damaging overpressure (impact area) and area of

Table 7(Same as Table 4 with the team choice highlighted).

Liquid release rate rate (lb/min)

Pressure vs. hole diameter

Psig/inches 1/16 1/8 1/4 1/2 1

10 2 8 31 120 50050 4 17 69 280 1100100 6 25 98 390 1600150 8 30 120 480 1900300 11 42 170 680 2700500 14 55 220 880 35001000 19 77 310 1200 50002000 27 110 440 1800 70006000 47 190 760 3000 1210010000 61 250 980 3900 X30000 110 420 1700 6800 X50000 137 550 2200 8800 X

occupancy (unit area). The premise is that as the impact areabecomes larger there is greater likelihood that personnel in the unitor in surrounding units will be impacted. Using 400 foot by 400 footas a typical unit footprint, an effective unit area was determined.The ratio of impact area derived from the model (3.5 psi zone)and the theoretical unit area was used to scale the overpressuredamage to the different consequence severities as shown in Table 5.

7. Worked example

A LOPA team was considering a potential pump seal leak(Figure 2).

Tower intercooler pump, 15 HP, pumping a rich oil saturatedwith C4.

Scenario e Deadheading pump resulting in a seal leak.Leak pressure e Pump head (30 psi) plus tower pressure

(60 psig).PHA severity e3 (severe injury).The PHA team had previously ranked this seal leak as a serious

injury event or a 3 on a 1e5 severity scale shown in Table 1. Asdescribed by LOPA team members who were also in the PHA, theseverity had been heavily debated and in the end no one wanted tounderestimate the hazard. The consensus was that this scenarioinvolved a hydrocarbon release and other hydrocarbon releases hadbeen ranked as a consequence severity of 3 by the team.

The LOPA team was introduced to the draft consequenceseverity guidance. It was emphasized that they had full authority tooverrule the results based on their experience or on-site-specificfactors, such as location of the pump.

7.1. Step 1

Estimate the hole diameter expected from a mechanical sealfailure (Table 6). The pump shaft size was not available to the team,but the pump horsepower, 15 HP, was shown on the P&ID. Thisyielded an equivalent hole diameter of ¼ inch.

1.5 2 3 4 6

1100 2000 4500 7900 179002500 4400 9980 17700 X3500 6300 14100 X X4300 7700 X X X6100 10900 X X X7900 X X X X11200 X X X XX X X X XX X X X XX X X X XX X X X XX X X X X

CW Intercooler

ValveCloses

Dead HeadingPump30 PSID

Pump Head

60 PSIGTower Pressure

AbsorptionColumn

Fig. 2. Example diagram showing the scenario under review.

A. Summers et al. / Journal of Loss Prevention in the Process Industries 24 (2011) 879e885 885

7.2. Step 2

Find the intersection of leak diameter and highest crediblepressure (Table 7). The team used 100 psig (the next selectionhigher than the 90 psig expected), the intersection with ¼ inchgives an expected leak rate of 98 pounds per hour.

7.3. Step 3

Use the expected leak rate to determine the consequenceseverity (Table 8). The team chose severity 2 based on the calcu-lated leak rate. Though the 98 pounds per hour is close to 100, theteam discussed other factors associated with the release to deter-mine whether severity 2 was appropriate versus severity 3. Thescenario involved the release of a lean oil mixture containing lightand heavy hydrocarbons. The heavier fractions in the lean oil arenot expected to flash to a vapor as easily as the general hydrocarbonclass. Consequently, the team selected consequence severity 2.

8. Conclusions

LOPA continues to be a great tool for semi-quantitative riskanalysis. A case can be made for alternatives to LOPA but in mostorganizations these alternatives are applied to specific hazards orapplications. LOPA teams, which include supervisory, technical andworker participation, can often address many hazardous events ina single meeting. All involved gain an appreciation of the thor-oughness of the analysis and the suitability of the IPL andrecommendations.

These teams apply LOPA to risks that range from relativelyminor issues to scenarios that could potentially destroy facilitiesand the lives of employees and neighbors. Different levels ofprotection are appropriate for different levels of risk, but incon-sistent levels of protection for the same level of risk can bring theLOPA process into question. Given the importance of achievingconsistent results it is necessary that tools and guidance be

provided to the teams to assess risks in an accurate and consistentmanner.

Attempts to improve consistency using standard LOPAtemplates or conditional modifiers introduce new variables into theassessment but do not address the root of the problem, which isoften an inconsistent consequence severity assessment. This paperproposes that PHA and LOPA teams be provided with look-up tablesthat give guidance on consequence severity based on equipmenttype and release conditions.

LOPA can be substantially improved by implementing conse-quence estimation tools that assist team members in under-standing the flammability, explosivity, and toxicity of processchemicals. When these tools can reliably and simply distinguishevents of different sizes, teams can understand and qualitativelydiscern the difference in severity between large loss of containmentevents versus small ones. The consequence severity tool discussedin this paper has proven to be awelcome development to the teamsthat have tried it. By increasing consistency in severity classifica-tion, the consistency of the final result is likewise improved.

References

CCPS/AIChE. (2008). Guidelines for hazard evaluation procedures (3rd ed.). New York:Wiley-Interscience.

CCPS/AIChE. (2001). Layer of protection analysis assessment. New York: ConceptSeries.

CCPS/AIChE. (2010). Guidelines for process safety metrics. New York: Wiley-Interscience.

CCPS/AIChE. (2007). Guidelines for Safe and Reliable Instrumented protective systems.New York: Wiley-Interscience.

OSHA. (1992). Process safety management of highly hazardous chemicals. 29 CFR Part1910.119, Federal Register 57, 36, Washington, DC.

CCPS/AIChE. (2009). Guidelines for developing quantitative safety risk criteria. NewYork.

Environmental Protection Agency (EPA). (1996). Accidental release preventionrequirements. 40 CFR Part 68, Federal Register 61, 120, Washington, DC.

Environmental Protection Agency (EPA). (February 2007). National Oceanic andAtmospheric Administration, “Aloha users manual,”. The CAMEO SoftwareSystem.