1. TUGAS K3 DALAM INDUSTRI KIMIA
CHAPTER 11
RISK ASSESSMENT
CHEMICAL PROCESS SAFETY – Fundamentals with Applications, 2nd Edition
Daniel A. Crowl/Joseph F. Louvar
SITI SITAWATI (NPM : )
Rev April 2011
DEPARTEMEN TEKNIK KIMIA - PROGRAM STUDI MANAGEMEN GAS
PROGRAM PASCA SARJANA UNIVERSITAS INDONESIA

2. CONTENTS
11-1 Review of Probability Theory
11-2 Event Trees
11-3 Fault Trees
11-4 Quantitative Risk Analysis (QRA) & Layers of Protection Analysis (LOPA)

3. 11-1 REVIEW OF PROBABILITY THEORY
EQUIPMENT FAILURES
Occur as a result of interaction of individual components
POISSON DISTRIBUTION
Probability that the component will not fail during the time interval (0,t):
R(t) = e-mt (11-1)
Where:
R = reliability
m = faults/time
t = time

4. 11-1 REVIEW OF PROBABILITY THEORY
Plot Failures:
Failure Rate, m
Failure Density, f(t)
(c) Failure Probability, P(t)
(d) Reliability, R(t)

5. FAILURE PROBABILITY (UNREALIBILITY)
11-1 REVIEW OF PROBABILITY THEORY
FAILURE PROBABILITY (UNREALIBILITY)
P(t) = 1 – R(t) = e-mt (11-2)
MEAN TIME BETWEEN FAILURES
Time interval between two failures of the component
E(t) = MTBF = 1 / m (11-3)

6. Typical Bathtub Failure Rate Curve for Process Hardware
11-1 REVIEW OF PROBABILITY THEORY
Typical Bathtub Failure Rate Curve for Process Hardware

7. Failure probabilities for individual components:
11-1 REVIEW OF PROBABILITY THEORY
Failure probabilities for individual components:
P = S Pi (11-4)
Where:
n = total number of components
Pi = failure probability of each component
Reliability probabilities for individual components:
R = S (1 - Ri) (11-5)
Where:
Ri = reliability of an individual process component
R = S (Ri)

8. Failure Rate Data for Selected Process Components
11-1 REVIEW OF PROBABILITY THEORY
Failure Rate Data for Selected Process Components

9. 11-1 REVIEW OF PROBABILITY THEORY
Computation of Component Linkage :
Simultaneous failure in parallel: logical AND function.
Simultaneous failure in series: logical OR function

10. 11-1 REVIEW OF PROBABILITY THEORY
Revealed Failures
Immediately obvious to operator and can be fixed in a negligible amount of time
Component Cycles for Revealed Failures

11. 11-1 REVIEW OF PROBABILITY THEORY
Without operator being aware of the situation until it affects
Unrevealed Failures
Component Cycles for Unrevealed Failures

12. 11-1 REVIEW OF PROBABILITY THEORY
Mean time between failures (MTBF) for revealed and unrevealed:
MTBF = 1 / m = tr t0 (11-12)
Where:
t0 = time that the component is operational, period of operation
tr = period of inactivity/downtime
ti = inspection interval

13. 11-1 REVIEW OF PROBABILITY THEORY
Probability of Coincidence:
Is required when there are dangerous due to process upset occurs and unavailability of emergency system
Average frequency of dangerous episode:
Where:
ld = dangerous frequency
l = frequency
pd = dangerous process episode
U = unavailability of emergency system
Ti = time interval

14. 11-1 REVIEW OF PROBABILITY THEORY
Mean Time Between Coincidence (MTBC):
Reciprocal average frequency of dangerous coincidences
Where:
ld = dangerous frequency
l = frequency
m = failure rate (failure/year)
ti = inspection period (year)

15. 11-2 EVENT TREES EVENT TREES
Inductive approach that provides information on how a failure can occur and the probability of occurrence
Used quantitatively if data are available on the failure rates of the safety function and the occurrence rate of the initiation event.
Useful for providing scenarios of possible failure modes.
Difficulty is that for most real processes the method can be extremely detailed, resulting in huge event tree.

16. 11-2 EVENT TREES
Event trees begin with an initiating event and work towards a final result with typical steps:
Identify an initiating event of interest
Identify the safety functions designed to deal with the initiating event
Construct the event tree
Describe the resulting accident event sequences

17. 11-2 EVENT TREES
EVENT TREE for loss of coolant accident for reactor:

18. 11-2 EVENT TREES
Computational Sequence in an Event Tree

19. 11-2 EVENT TREES
Typical Event Tree of a Reactor

20. 11-3 FAULT TREES FAULT TREE
Is a deductive method for identifying ways in which hazards can lead to accidents:
Well-defined accident  top event  works backward toward the various scenarios that can cause the accident
Preliminary steps before actual fault tree is drawn:
Define precisely the top event
Define existing event
Define unallowed events
Define the physical bounds of the process
Define the equipment configuration
Define the level of resolution

21. 11-3 FAULT TREES
Typical Fault Tree Contributing to a Flat tire

22. 11-3 FAULT TREES
Logic Transfer Component of a Fault Tree

23. 11-3 FAULT TREES
Typical Fault Tree of Reactor Overpressure

24. 11-3 FAULT TREES Minimal Cut Set
Is various sets of events that leads to top event.
Determined using Fussel & Vesely Procedure
Some of the minimal cut set have higher probability than others
Ordered with respect to failure probability
Quantitative Calculation Using Fault Tree
Computation by Fault Tree Diagram, using AND gate & OR gate until top event
Computation by Minimal Cut Set Procedure

25. 11-3 FAULT TREES Drawing Fault Tree:
Draw the top event at the top of the page
Determine major events that contribute to the top event
Parallel  connected by AND gate ;
Series  connected by OR gate
Determine intermediate events that contribute to the top event
Expand intermediate events that contribute to the top event

26. 11-3 FAULT TREES Disadavantages of Fault Trees
For complicated process becomes enormous
Not certain if all failure modes have been considered
A particular item of hardware does not fail partially
Failure of one component does not stress the other components
Subjective dependence of individuals
Requires failure probabilities of all events in the fault tree

27. 11-3 FAULT TREES Advantages of Fault Trees:
It begins with a top event, which is selected by user to be specific to the failure of interest
Used to determine the minimal cut sets, which provides enormous insight into various ways for top events to occur
Enables application of computers, which is available for construct fault trees, determining minimal cut set, calculating failure probabilities

28. 11-4 QRA & LOPA Quantitative Risk Analysis
Identify where operations, engineering, or management systems can be modified to reduce risk.
Design to provide managers with a tool to help them evaluate the overall risk of a process.
Evaluate potential risks when qualitative methods cannot provide an adequate understanding of risks
Relatively complex procedure that requires expertise and a substantial commitment of resources and time.

29. 11-4 QRA & LOPA Major steps of QRA study include:
Define potential event sequences and potential incidents
Evaluate incident consequences (typical tools for this step
include dispersion modeling and fire explosion modeling)
Estimate potential incident frequency using event trees and fault trees
Estimate incident impacts on people, environment, and property, and
Estimate the risk by combining the impacts and frequencies, and recording the risk using a graph

30. 11-4 QRA & LOPA Layer of Protection Analysis
Semi-quantitative too for analyzing and assessing risk
Simplified methods to characterize the consequences and estimate the frequencies,
Various layers of protection are added to a process to lower frequency of the undesired consequences
Consequences and affects are approximated by categories, the frequencies are estimated, and the effectiveness of the protection layers is also approximated.
Individual companies use different criteria to establish the boundary between acceptable and unacceptable risk.

31. 11-4 QRA & LOPA
Typical Layer of Protection Analysis of a Specific Accident Scenario

32. 11-4 QRA & LOPA Major steps of QRA study include:
Identify a single consequence
Identify an accident scenario and cause associated with the consequence
Identify the initiating event for the scenario and estimating the initiating event frequency
Identify protection layers available for consequence and estimating the probability of failure on demand (PFD) for each protection layer
Combining the initiating event frequency with the PFD for the independent protection layers to estimate a mitigated consequence frequency
Plotting the consequences versus the consequence frequency to estimate the risk
Evaluating the risk for acceptability

33. 11-4 QRA & LOPA Consequence
Most common scenario of interest for LOPA is loss of containment of hazardous material occurred through variety of incidents such as leak from a vessel, ruptured pipeline, gasket failure, release from a relief valve
Consequences are estimated using the following methods:
Semi-quantitative approach without the direct reference to human harm
Qualitative estimates with human harm
Quantitative estimates with human harm

34. 11-4 QRA & LOPA
Semi-Quantitative Consequences Categorization

35. 11-4 QRA & LOPA
Frequency
Methods to determine frequency includes the following steps:
Determine failure frequency of initiating event
Adjust the frequency to include the demand
Adjust the failure frequency to include probabilities of failure on demand (PFDs) for each independent layer of protection
Probabilities of failure on demand (PFD) for each independent protection layer (IPL) varies from:
10-1 for a weak IPL
10-2 for a common practice IPL
10-5 for a strong IPL

36. 11-4 QRA & LOPA
Three rules for classifying a specific system or action of an IPL:
IPL is effective in preventing the consequence when it function as designed
IPL functions independently of the initiating event and the components of all other IPLs that are used for the same scenario
IPL is auditable, that is, the PFD of the IPL must be capable of validation including review, testing, and documentation

37. 11-4 QRA & LOPA
Frequency Values Assigned to Initiating Events

38. 11-4 QRA & LOPA
PFD concept is used when designing emergency shutdown system called safety instrumented functions (SIFs).
A SIF achieves low PFD figures by:
Using redundant sensors and final redundant control elements
Using multiple sensors with voting systems and redundant final control elements
Testing the system components at s specific intervals to reduce the PFD by detecting hidden failures
Using deenergized trip system (i.e., a relayed shutdown system)

39. 11-4 QRA & LOPA
PFDs for Passive IPLs

40. 11-4 QRA & LOPA
PFDs for Active IPLs and Human Actions

41. 11-4 QRA & LOPA Consequence Frequency of Specific Scenario Endpoint
Consequence Frequency of Multiple Scenario Endpoint
Where:

42. 11-4 QRA & LOPA
Safety Integrated Levels (SILs) for emergency shutdown system:
SIL1 (PFD = 10-1 to 10-2): implemented with a single sensor, a single logic solver, a single final control element, and requires periodic proof testing
SIL2 (PFD = 10-2 to 10-3): typical fully redundant, including the sensor, a single logic solver, a single final control element, and requires periodic proof testing
SIL3 (PFD = 10-3 to 10-4): typical fully redundant, including the sensor, a single logic solver, a single final control element, and requires careful design and frequent validation test to achieve low PFD figures.

43. THANK YOU