Consistent consequence severity estimation

Consistent Consequence Severity EstimationAngela Summers, William Vogtmann, and Steven SmolenSIS-TECH Solutions, 12621 Featherwood Dr Suite 120 Houston, TX 77034; [email protected] (for correspondence)

Published online 4 December 2011 in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/prs.10502

Most risk analysis methods rely on a qualitative judgmentof consequence severity, regardless of the analysis rigorapplied to the estimation of hazardous event frequency. Asthe risk analysis is dependent on the estimated frequency andconsequence severity of the hazardous event, the error associ-ated with the consequence severity estimate directly impactsthe estimated risk and ultimately the risk reduction require-ments. Overstatement of the consequence severity creates ex-cessive risk reduction requirements. Understatement results ininadequate risk reduction.

Consistency in the consequence severity estimate can besubstantially improved by implementing consequence estima-tion tools that assist process hazards analyses/layers of protec-tion analysis (PHA/LOPA) team members in understandingthe flammability, explosivity, or toxicity of process chemicalreleases. This article provides justification for developing semi-quantitative look-up tables to support the team assessment ofconsequence severity. Just as the frequency and risk reductiontables have greatly improved consistency in the estimate ofthe hazardous event frequency, consequence severity tablescan significantly increase confidence in the severity estimate.� 2011 American Institute of Chemical Engineers Process SafProg 31: 9–16, 2012

Keywords: layers of protection analysis; risk analysis; con-sequence; quantitative

INTRODUCTIONVarious types of process hazards analyses (PHA) are now

in widespread use throughout the process industry [1]. Theseanalyses evaluate process deviations that potentially lead tohazardous events and the safeguards that are implemented toreduce the likelihood of each event. Many PHAs incorporaterisk analysis to determine the residual risk of each identifiedevent to determine if additional safeguards are needed. This isaccomplished by qualitatively estimating the likelihood of theevent given its causes and safeguards and the magnitude ofthe consequence severity without safeguards. The PHA pro-cess can be supplemented with layers of protection analysis(LOPA) to provide an order of magnitude estimate of the haz-ardous event frequency by assessing the frequency of the ini-tiating events that lead to the hazardous event and the proba-bility that the safeguards fail [2].

One of the authors has often stated ‘‘A big risk is notaddressed by a big list: it is addressed with the right list of in-dependent protection layers (IPL).’’ A big risk generallyinvolves an event judged to have a consequence severity of apotential significant injury or fatality. PHA teams often deal

with big risks by ensuring that there is a big list of safeguards,thus, making the event seem much less likely when the teamis asked to qualitatively assess the potential hazardous eventlikelihood considering the causes and safeguards. In mostPHAs, safeguards are recommended if they reduce the eventlikelihood by a little or a lot. However, the expectation is thateverything on the list is safety-related and is managed withthe same degree of rigor. Instead of a big safeguard list, anowner/operator needs to identify safeguards that have beendemonstrated to provide risk reduction.

LOPA begins with an estimate of the likelihood of rootcauses (or initiating causes) and enabling conditions, whichresult in process deviations (or initiating events). In basicLOPA, the likelihood of the initiating event is estimated on anorder of magnitude basis. Some advanced LOPA techniquesuse detailed fault trees and field data analysis to support thelikelihood estimate. Regardless of the frequency estimate pre-cision, if the risk of the initiating event (frequency and conse-quence severity) is higher than the company risk criteria, theteam identifies IPL that provide sufficient risk reduction tomeet the risk criteria.

IPL are typically a subset of the safeguards listed in the PHA.As each candidate safeguard is considered, the LOPA teamdetermines whether the safeguard meets seven core attributesthat are required for it to be considered IPL, namely, independ-ence, integrity, reliability, functionality, access security, manage-ment of change, and auditability. In some applications, IPL aredictated by industrial practices to ensure that equipment is prop-erly protected based on a particular sector’s understanding ofthe potential for hazardous events. In all cases, to take credit foran IPL in LOPA, it must be assured that it can provide theclaimed risk reduction based on an analysis of its design andmanagement.

The characterization of the initiating event frequencies andIPL risk reduction in order of magnitude terms allows teamswith little mathematical inclination to estimate the hazardousevent frequency based on information and data that corre-spond to key performance indicators [2,3]. In most cases, theteam is provided with look-up tables of typical initiating causefrequencies and IPL risk reduction values that can be adjustedbased on specific site experience, so the estimated hazardousevent frequency is generally very consistent from team toteam. As advanced LOPA procedures make more precise esti-mates of the frequency of the events and probability of IPLfailure, the hazardous event frequency estimate becomesmore quantitative, but the method remains inherently semi-quantitative due to the qualitative estimation of consequenceseverity.

The logical next step in improving LOPA is to introduceguidance for estimating the consequence severity using anorder of magnitude approach. The following discussionpresents the authors’ proposal for semiquantitative selectionof consequence severity associated with flammable releasesbased on the zone of overpressure generated on ignition of

Originally presented at the AIChE 2010 Global Congress on Process Safety,San Antonio, March 2010.

� 2011 American Institute of Chemical Engineers

Process Safety Progress (Vol.31, No.1) March 2012 9

the material. Simple look-up tables are presented that relyon equipment design specifications and process operatingconditions – information that should already be maintainedby the site and provided to the team that is conducting theanalysis.

Dispersion modeling based on the EPA’s worst-caserelease scenario assumptions [7] as well as the guidance docu-mented in the EPA/NOAA dispersion modeling tool [8] wasused to correlate estimated release rates to ‘‘zones of damag-ing overpressure’’ generated when the released materialignited. Then, these zones were tied to the consequence se-verity rankings that typically support risk analyses during thePHA and LOPA. The look-up tables have been demonstratedto yield a consistent basis for estimating the consequence se-verity, leading to greater consistency in the risk estimateregardless of the team experience with harmful events.

LOPA IS A GREAT TOOL!LOPA is an excellent tool for assessing a wide variety of

process hazard scenarios and then crediting or applying pro-tection layers of appropriately robust design. LOPA, as a semi-quantitative analysis, allows for efficient evaluation of processhazards by a multidisciplined team of representatives that areexperienced with the equipment under study. The results arebased on a better estimate of the hazardous event frequencyand therefore provide a stronger basis for recommendingsafety functions or layers.

LOPA supports performance-based process safety becauseit ties various quality assurance metrics or key performanceindicators to the hazardous event frequency. As owner/opera-tors track the challenges on their IPLs and failures of theirIPLs, LOPA provides a means to compare order of magnitudeestimates of historical performance to industry-benchmarkedvalues.

Fortunately, process safety incidents are infrequent in theprocess industry, so most teams have little experience withhazardous events. On the other hand, teams do have experi-ence with the root causes (or initiating causes), process devia-tions (or initiating events), and failed IPLs. Thus, when thehazardous event is broken down into the initiating causes andIPLs, the event frequency can be understood by all disciplinesand those disciplines that impact the event frequency can bet-ter understand their role in hazardous event propagation.Done right, it gives the organization a firm and consistent ba-sis for investment in protective systems.

LOPA IS INCONSISTENT!As organizations progress with LOPA, invariably the results

for similar equipment and process units are compared andquestions are asked about the differences. It is not unusual tosee variation in the risk estimate for similar hazardous eventsin nearly identical process units. As most LOPA procedureshave well-defined methods for estimating the hazardous eventfrequency, the inconsistency in the risk estimate is often dueto variation in the estimated consequence severity.

Most LOPA methods rely on a qualitative estimate of theconsequence severity. Table 1 provides an example of typicalconsequence severity descriptions. These descriptions areessentially statements of harm that the team is expected tojudge based on the propagation of the process deviation intoa hazardous event and ultimately to harm. Although the teammembers may have experience in process deviations, hope-fully, they have little experience with hazardous events andthe resulting harm.

The severity estimate is often bounded with qualitativeguidance that the team should estimate the ‘‘worst case conse-quence’’ or ‘‘worst credible consequence.’’ For example, theworst credible scenario is ‘‘the most severe incident of all

Table 1. Qualitative consequence severity ranking.

Ranking Safety Environmental Asset

5 Multiple fatalities across afacility and/or injuries orfatalities to the public

Catastrophic off-siteenvironmental damage withlong-term containment andclean-up

Expectant loss greater than$10,000,000 and/or substantialdamage to buildings locatedoff-site

4 Hospitalization of three ormore personnel (e.g., seriousburns, broken bones) and/orone or more fatalities within aunit or local area and/orInjuries to the public

Significant off-siteenvironmental damage (e.g.,substantial harm to wildlife)with prolonged containmentand clean-up

Expectant loss between$1,000,000 and $10,000,000and/or extended downtimewith significant impact to thefacility operationand/or minor damage (e.g.,broken windows) to buildingslocated off-site

3 Hospitalization injury (e.g.,serious burns, broken bones)and/or multiple lost work dayinjuries and/or injury to thepublic

On-site release requiringcontainment andclean-up and/or off-siterelease causing environmentaldamage with quick clean-up

Expectant loss between$100,000 and $1,000,000 and/or downtime of several daysseverely impacting the facilityoperation

2 Lost work day injury and/orrecordable injuries (e.g., skinrashes, cuts, burns) and/orminor impact to public

On-site release requiringcontainment andclean-up by emergencypersonnel and/or off-siterelease (e.g., odor) but noenvironmental damage

Expectant loss between$10,000 and $100,000 and/ordowntime of more than daycausing impact to facilityoperation and/or reportablequantity event

1 Recordable injury and/or noimpact to the public

On-site release requiringcontainment andclean-up by on-site personnel

Expectant loss of less than$10,000 and/or downtime ofless than a day with minorimpact to the facility operation

10 March 2012 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.31, No.1)

identified outcomes and their consequences that is consideredplausible or reasonably believable’’ [4]. The interpretation ofthese terms and their definitions has proven to be highly vari-able. The perceived error in this severity estimate is one ofthe chief criticisms of PHA and LOPA. And, unfortunately,perception often drives investment, so if it is perceived thatthe team was excessively conservative in the consequence se-verity estimate, it is easier for management to reject PHA andLOPA recommendations as unwarranted.

There are many legitimate reasons for variation in the con-sequence severity estimate across an organization, includingdifferences in the specific process quantities, layout, location,equipment pressure ratings, etc. These differences are recog-nized by the respective teams and result in different conse-quence severity rankings. In many cases, these specific differ-ences are not fully described in the PHA or LOPA documenta-tion, making it difficult for people who were not part of theteam to understand why the differences exist. Variation inresults is not necessarily an indicator that teams are perform-ing the analysis incorrectly. Indeed it often reflects why PHAand LOPA are performed on specific equipment and processunits, and why these studies are revalidated periodically tocapture lessons learned in operating and maintaining theequipment.

A significant amount of variation is introduced due to per-ceptual differences of the hazardous situation created by thehazardous event. Bias may also be introduced into teams bythe presence of risk-taking or risk-adverse people. Direct ex-perience with the hazardous event is a strong influence onthe estimate. For example, where a site or team member hasexperienced a fire and no one was hurt, the assumed out-come for any fire may become ‘‘no one gets hurt.’’ If there isexperience where people were hurt or killed by the fire, evendue to extremely unusual conditions, all events resulting in apotential fire may be regarded as a fatality event. Although noone should take any fire lightly, the concept of risk analysiscertainly incorporates the idea that large fires should receivemore attention and effort in prevention than small ones, otherfactors being equal.

These qualitative biases may be great enough to push theseverity estimate to a more or less conservative result than isappropriate. Overstatement of severity creates excessive riskreduction requirements and costs. Understatement results ininadequate risk reduction and a higher potential for loss events.Providing the team with a semiquantitative basis for the sever-ity assessment can significantly reduce variability.

CONDITIONAL MODIFIERS CAN (NOT) FIX IT!Basic LOPA analyzes the risk for each hazardous event

resulting from one or more process deviations. Basic LOPAfocuses the risk analysis on preventing hazardous events,which reduces the potential for harm and event escalation.This agrees with OSHA 29 CFR 1910.119 [5], which is not onlydedicated in just ‘‘minimizing the consequences of cata-strophic releases of toxic, reactive, flammable, or explosivechemicals’’ but also in ‘‘preventing’’ such releases. The typicalLOPA risk criteria are that the maximum hazardous event fre-quency should not exceed 1 3 1024/yr for events potentiallyleading for a worker fatality or 1 3 1025/yr for events poten-tially leading to a public fatality [6]. The overall frequency ofall deviations leading to the same hazardous event shouldachieve these risk criteria. Many risk matrices have similar riskcriteria built into the relationship between frequency and con-sequence severity as illustrated in Table 2 [4].

Some owner/operators use LOPA to support risk criteriabased on the harmful event frequency. Some regulatoryauthorities require that the maximum individual risk or soci-etal risk be determined and reported as part of permitting orsafety cases. Once the hazardous event frequency is known,

the team assesses site-specific conditions (e.g., probability ofignition and probability of occupancy) to determine the harm-ful event frequency. The probability values assumed for con-ditional modifiers whether used in LOPA or QRA (quantitativerisk analysis) should be justified through application-specificanalysis. Typical risk criteria are a maximum individual risk of1 3 1025/yr or 1 3 1026/yr for societal risk [6]. Assessmentagainst these risk criteria requires that the overall frequencyof all deviations leading to the same hazardous event bedetermined.

Conditional modifiers are often proposed as a means todeal with overstated consequence severity. As the conditionalmodifiers reduce the frequency, the ‘‘risk’’ is likewise lowered.However, the use of conditional modifiers also depends onthe basis for the risk analysis. It is not appropriate to use con-ditional modifiers if the risk criteria are based on the hazard-ous event frequency (e.g., loss of containment) rather than ondirect harm frequency (e.g., fatality). Regardless of the fre-quency basis, the use of conditional modifiers does notaddress or minimize the error associated with the conse-quence severity estimate. It does provide a means to rational-ize that the likelihood of such harm is lower; however, theconsequence is still overstated.

TEMPLATES CAN (NOT) FIX ITSome owner/operators have tried to get consistency in the

LOPA by providing teams with standard LOPA scenarios forspecific process units. This is especially attractive in organiza-tions with virtually identical units or highly standardizedinstallations in multiple locations. These template scenarioscan be very useful in giving specific guidance to a team. Inmany cases, the templates list IPLs that are considered goodengineering practice, so teams have guidance on not only therisk but also the means for risk reduction. The use of tem-plates does not restrict the team’s ability to analyze the risk ofa specific installation, since the team is still expected to iden-tify significant differences between their installation and thetemplate and to make adjustments to the template as neces-sary. However, such templates have proven to be difficult todevelop, approve, and implement, predominantly becauseconsensus on an organization-wide consequence severityranking is difficult to achieve. In practice, teams can becomeexcessively focused on the differences between the templateand the actual plant design and operation. In some cases,these differences are a significant distraction to the evaluationof the postulated hazardous event.

DEVELOPING CONSEQUENCE SEVERITY GUIDANCEThe authors developed a set of consequence severity look-

up tables to support PHA and LOPA using dispersion model-ing. The keep it simple and straightforward (KISS) principle

Table 2. Example risk matrix.

ConsequenceSeverity Required Risk Reduction Factor

5 100,000 10,000 1,000 100 104 10,000* 1,000 100 10 TR3 1,000 100 10 TR TR2 100 10 TR TR TR1 10 TR TR TR TR

1 10 100 1,000 10,000Frequency (1 in x years)

*Hazardous event frequency 5 1 3 1024/yr for impact toworker or 1 3 1025/yr for impact to public.

Process Safety Progress (Vol.31, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2012 11

was applied to the modeling effort, since the model wasintended to be conservative and support order of magnitudeconsequence severity estimation. It was also desirable to havetables that based the severity on something that the teamcould assess themselves using information typically providedto the PHA or LOPA team. The results also needed to be pre-sented in a format that made the tool practical for the team touse. Ultimately, a set of look-up tables were developed whichyielded a severity ranking or range of severities, dependingon the equipment type and release conditions.

As many events that pose significant risk involve therelease of flammable materials, the first look-up tablesaddressed flammable hydrocarbon releases. Alkanes andalkenes, including C1–C10, are widely used in the processindustry, so these were selected for modeling using ALOHA�

(Areal Locations of Hazardous Atmospheres) [8]. It wasdetermined that this set of hydrocarbons yielded relativelysimilar zones of damaging overpressure for a given hole di-ameter and release rate. Consequently, the tables were sim-plified by treating these compounds as a single class ofhydrocarbons.

Guidance was also needed to relate the initiating eventconditions to an expected hole diameter or damage estimate.This led to the development of tables relating pump size(shaft size or HP) to an equivalent seal hole diameter, per-centage overpressure to an equivalent hole diameter, or fire-box type to equivalent damage. This article will only presentthe pump size correlations for the loss of a mechanical seal.

DisclaimerThis guidance is intended to produce consistent results

for similar hazardous events, but no severity estimate is aperfect forecast of actual events. Where plant conditions aresignificantly different from the assumptions, additional stud-ies and/or consequence modeling should be considered.The PHA or LOPA team is advised to reach a consensuson consequence severity, considering site specific factors,the consequence severity tables, specific modeling results,and other available information. Ultimately, the guidance isintended to release teams from concern that they are nottreating safety seriously if they do not consider all releasesas high severity and the opposite concern that they arebeing too conservative about the process if they predictthat many scenarios pose severe consequences.

Dispersion ModelingKeeping everything simple was probably the highest hur-

dle to overcome. It was easy to become overwhelmed withthe different modeling tools and the large number of parame-ters that could be specified. Fortunately, analysis paralysiswas ended by accepting the worst-case release scenarioassumptions used to support the EPA risk management plan[7] as well as the guidance documented in the EPA/NOAA dis-persion modeling tool [8]. The simplifying assumptions madewere:

• Weather/topographical conditions

� Wind: 3 knots from South at 3 m� Ground roughness: open country� Air temperature: 958F� Stability Class: B – software determined

Note: ALOHA provides the stability class based on infor-mation about the time of day, wind speed, and cloud cover.

� No inversion height� Cloud cover: 5 tenths� Relative humidity: 50%

• Congestion• Congested – not open space, difficult to walk through

The dispersion modeling software chosen was ALOHA,which was developed by the EPA’s Office of EmergencyManagement and NOAA’s Emergency Response Division.ALOHA is an atmospheric dispersion model used for evaluat-ing releases of hazardous chemicals, including toxic gasclouds, fires, and explosions. Using input about the releaseALOHA generates a threat zone estimate. A threat zone isthe area where a hazard (such as toxicity, flammability, ther-mal radiation, or damaging overpressure) is predicted toexceed a user-specified level of concern.

The major reasons for selecting this software were that itwas:

• developed by EPA/NOAA for use in a site’s risk manage-ment plan (RMP) and emergency response plans (ERP)

• familiar to local emergency planning committees (LEPC)since many companies used the software for their RMPcase(s)

• user friendly

� often provided suggested/recommended values forparameters making it more suitable for the what-iftype of modeling required

� includes guidance on severity-based threat zone� availability of large database of hazardous materials

• available at no cost to the user as well as the general pub-lic (LEPC)

Covered ChemicalsThe consequence severity look-up table addresses the haz-

ards associated with the release of flammable liquids andvapors in the range of C1–C10 (alkanes and alkenes). Theconsequence severity of the hazardous event was defined bythe zone of damaging overpressure generated when the flam-mable hydrocarbons were released from a defined hole diam-eter at a specified rate. This model did not consider thepotential for pool fires, flash fire, or jet fires. It also did notconsider potential secondary effects resulting from overpres-sure or fire exposure, which could impact surrounding pro-cess equipment and cause additional failures.

Hole Diameter EstimateHole diameter look-up tables were developed for vessel

and piping overpressure and seal leaks. This article onlypresents the results for estimating the hole diameter for singlemechanical seals. As shown in Table 3, the hole diameter canbe estimated based on the pump shaft size at the seal or onhorsepower. The shaft size (Table 3A) may be a more accu-rate predictor of hole diameter, but experience indicates thathorsepower (Table 3B) is more commonly available to theteam. The information may be included on unit P&IDs or inmechanical data sheets.

Release Rate EstimateFor the flammable hydrocarbons, separate release rate

tables were developed for liquid and vapor releases. Theteam determines whether the release will be liquid or vaporconsidering process conditions when the hazardous eventoccurs. Table 4 is for liquid releases through holes of 1/16 in.to 6 in. in diameter at pressures of 10–50,000 psig. The pres-ence of an ‘‘X’’ in the table indicates a release that exceedsthe threshold of 10,000 lbs/min, which was determined to cor-relate with a category 5 consequence severity.


Zones of Damaging OverpressureModeling of the selected hydrocarbons under the condi-

tions stated in ‘‘Dispersion Modeling’’ section showed that themajority of the releases reached steady state with clearly iden-tified zones of hazardous conditions within 5 min, which isconsistent with the EPA’s RMP guidance to use an endpoint of10 min for scenario modeling. Figure 1 is a screen captureshowing a typical output from ALOHA�.

The ALOHA output depicts three predefined ‘‘zones ofdamaging overpressure.’’ The yellow zone (outer ellipse) is anoverpressure greater than 1 psi. This pressure typically causesminor damage to structures and minimal direct harm tohumans. The ALOHA output includes a reference to shatteredglass to indicate that 1 psi is a minor impact. The orangezone (inner ellipse) is an overpressure greater than 3.5 psi.This pressure typically causes structural damage to buildingsand direct harm to humans. The ALOHA output includes areference to serious injury to indicate that 3.5 psi represents apoint where injuries are likely due to the overpressure, butthis reference does not consider the potential for flying debrisor structural damage. There is a potential for a red zone toappear on the graphic when there is an overpressure greaterthan 8.0 psi. This pressure is known to cause significant struc-tural damage to structures and buildings as well as directharm to human. The ALOHA output includes a reference todestruction of buildings to indicate the severity of this over-pressure.

Examination of the results obtained from the modeling ofthe hydrocarbon class (consisting of C1–10 alkanes andalkenes) identified no red zones (8 psi). This agrees withother data reviewed before modeling, which suggested that itwas unlikely that typical hydrocarbon releases within processunits would achieve this degree of overpressure.

The zone represented by the 3.5 psi overpressure seemedlike a conservative selection for determining the potential areaimpacted by the overpressure, since this overpressure wasjudged to be significant enough to cause direct injury and toresult in flying debris. It was also felt to be more intuitive forthe correlation since the qualitative consequence severitydescriptions include the potential for injury and fatality.Selecting a higher overpressure for the correlation wouldhave resulted in a smaller impact area, but a more severe out-come within the area.

To correlate overpressure damage to differing levels ofconsequence severity, it was necessary to establish a relation-ship between zone of damaging overpressure (impact area)and area of occupancy (unit area). The premise is that as theimpact area becomes larger there is greater likelihood thatpersonnel in the unit or in surrounding units will be impacted.Using 400 ft by 400 ft as a typical unit footprint, an effectiveunit area was determined. The ratio of impact area derivedfrom the model (3.5 psi zone) and the theoretical unit areawas used to scale the overpressure damage to the differentconsequence severities as shown in Table 5.

Table 4. Liquid release rate (lb/min) as a function of pressure and hole diameter.

Liquid Release Rate (lb/min)Pressure Versus Hole diameter

psig/in 1/16 1/8 1/4 1/2 1 1.5 2 3 4 6

10 2 8 31 120 500 1,100 2,000 4,500 7,900 17,90050 4 17 69 280 1,100 2,500 4,400 9,980 17,700 X100 6 25 98 390 1,600 3,500 6,300 14,100 X X150 8 30 120 480 1,900 4,300 7,700 X X X300 11 42 170 680 2,700 6,100 10,900 X X X500 14 55 220 880 3,500 7,900 X X X X

1,000 19 77 310 1,200 5,000 11,200 X X X X2,000 27 110 440 1,800 7,000 X X X X X6,000 47 190 760 3,000 12,100 X X X X X10,000 61 250 980 3,900 X X X X X X30,000 110 420 1,700 6,800 X X X X X X50,000 137 550 2,200 8,800 X X X X X X

‘‘X’’ 5 no details are provided, since the release is equivalent to category 5.

Table 3. Estimated equivalent hole diameter for single mechanical seal failure.

(A) Shaft Size (in.) Versus Equivalent Hole Diameter (in.)*

Shaft 0.5 1 2 3 4 6 8Hole 1/8 3/16 1/4 3/8 1/2 5/8 3/4

(B) Horsepower Versus Equivalent Hole Diameter (in.)**

HP <5 5–10 10–50 50–150 150–300 300–600 >600Hole 1/8 3/16 1/4 3/8 1/2 5/8 3/41

*The equivalent hole diameter estimate assumes that the carbon faces and their support within the seals provide no sealing. Theremaining leak path is limited by the clearance between the shaft and the seal housing/support. An annular radius of 0.01 wasused for small shaft sizes (up to 3 in.) and 0.016 was used for larger shafts.**The equivalent hole diameter estimate was developed by reviewing the output shaft size of typical industrial motors rated forvarious HP. The review indicated that the pumps could be grouped for simplification of the look-up table. The stated equivalenthole diameter is based on the shaft sizes for the upper boundary of each group.


WORKED EXAMPLE

• A LOPA team was considering a potential pump seal leak(Figure 2).

• Tower intercooler pump, 15 HP, pumping a rich oil satu-rated with C4.

• Scenario: deadheading pump resulting in a seal leak.• Leak pressure: pump head (30 psi) plus tower pressure (60psig).

• PHA severity: 3 (severe injury).

The PHA team had previously ranked this seal leak as aserious injury event or a 3 on a 1–5 severity scale shown inTable 1. As described by LOPA team members who were alsoin the PHA, the severity had been heavily debated and in theend no one wanted to underestimate the hazard. The consen-sus was that this scenario involved a hydrocarbon release andother hydrocarbon releases had been ranked as a conse-quence severity of 3 by the team.

The LOPA team was introduced to the draft consequenceseverity guidance. It was emphasized that they had fullauthority to overrule the results based on their experience oron site specific factors, such as location of the pump (Tables6–8).

Step 1Estimate the hole diameter expected from a mechanical

seal failure. The pump shaft size was not available to theteam, but the pump horsepower, 15 HP, was shown on theP&ID. This yielded an equivalent hole diameter of in.

Step 2Find the intersection of leak diameter and highest credible

pressure. The team used 100 psig (the next selection higher

Figure 1. Screen capture showing a typical output from ALOHA�. [Color figure can be viewed in the online issue, which isavailable at wileyonlinelibrary.com]

Table 5. Potential safety consequence severity. Release offlammable gas or flashing liquid withinan operating unit.

Leak Rate (lb/min)Impact Area(Unit Area) Severity

10,000 And over >1.00* 51,000 10,000 0.66 � 1.00* 4100 1,000 0.33–0.66 310 100 0.16–0.33 20 10 <0.16 1

*Upper bound is 3.5 psi over three times unit area.

Figure 2. Example diagram showing the scenario underreview.


than the 90 psig expected), the intersection with in. gives anexpected leak rate of 98 lbs/min.

Step 3Use the expected leak rate to determine the consequence

severity. The team chose severity 2 based on the calculatedleak rate. Though the 98 lbs/min is close to 100, the team dis-cussed other factors associated with the release to determinewhether severity 2 was appropriate versus severity 3. The sce-nario involved the release of a lean oil mixture containinglight and heavy hydrocarbons. The heavier fractions in thelean oil are not expected to flash to a vapor as easily as thegeneral hydrocarbon class. Consequently, the team selectedconsequence severity 2.

CONCLUSIONSLOPA continues to be a great tool for semiquantitative risk

analysis. A case can be made for alternatives to LOPA but inmost organizations these alternatives are applied to specifichazards or applications. LOPA teams, which include supervi-sory, technical, and worker participation, can often addressmany hazardous events in a single meeting. All involved gainan appreciation of the thoroughness of the analysis and thesuitability of the IPL and recommendations.

These teams apply LOPA to risks that range from relativelyminor issues to scenarios that could potentially destroy facili-ties and the lives of employees and neighbors. Different levelsof protection are appropriate for different levels of risk, butinconsistent levels of protection for the same level of risk canbring the LOPA process into question. Given the importanceof achieving consistent results, it is necessary that tools andguidance be provided to the teams to assess risks in an accu-rate and consistent manner.

Attempts to improve consistency using standard LOPA tem-plates or conditional modifiers introduce new variables intothe assessment but do not address the root of the problem,which is often an inconsistent consequence severity assess-

ment. This article proposes that PHA and LOPA teams be pro-vided with look-up tables that give guidance on consequenceseverity based on equipment type and release conditions.

LOPA can be substantially improved by implementing con-sequence estimation tools that assist team members in under-standing the flammability, explosivity, and toxicity of processchemicals. When these tools can reliably and simply distin-guish events of different sizes, teams can understand andqualitatively discern the difference in severity between largeloss of containment events versus small ones. The conse-quence severity tool discussed in this article has proven to bea welcome development to the teams that have tried it. Byincreasing consistency in the severity estimate, the consistencyof the final result is likewise improved.

LITERATURE CITED

1. CCPS/AIChE, Guidelines for Hazard Evaluation Proce-dures, 3rd ed., Wiley-Interscience, New York, 2008.

2. CCPS/AIChE, Layer of Protection Analysis: SimplifiedProcess Risk Assessment, Concept Series, New York,2001.

Table 6. From Table 3B with the team choice highlighted.

Horsepower Versus Equivalent Hole Diameter

HP <5 5–10 10–50 50–150 150–300 300–600 >600Hole (in.) 1/8 3/16 1/4 3/8 1/2 5/8 3/41

Table 7. Same as Table 4 with the team choice highlighted.

Liquid Release Rate (lb/min)Pressure Versus Hole Diameter

psig/in. 1/16 1/8 1/4 1/2 1 1.5 2 3 4 6

10 2 8 31 120 500 1,100 2,000 4,500 7,900 17,90050 4 17 69 280 1,100 2,500 4,400 9,980 17,700 X

100 6 25 98 390 1,600 3,500 6,300 14,100 X X150 8 30 120 480 1,900 4,300 7,700 X X X300 11 42 170 680 2,700 6,100 10,900 X X X500 14 55 220 880 3,500 7,900 X X X X

1,000 19 77 310 1,200 5,000 11,200 X X X X2,000 27 110 440 1,800 7,000 X X X X X6,000 47 190 760 3,000 12,100 X X X X X10,000 61 250 980 3,900 X X X X X X30,000 110 420 1,700 6,800 X X X X X X50,000 137 550 2,200 8,800 X X X X X X

Table 8. Same as Table 5 with the team choice highlighted.

Leak Rate (lb/min) Severity

10,000 And over 51,000 10,000 4100 1,000 310 100 2*

0 10 1

*98 lbs/min.


3. CCPS/AIChE Guidelines for Process Safety Metrics, Wiley,New York, 2010.

4. CCPS/AIChE, Guidelines for Safe and Reliable Instru-mented Protective Systems, Wiley-Interscience, New York,2007.

5. OSHA, Process Safety Management of Highly HazardousChemicals, 29 CFR Part 1910.119; Federal Register, Vol. 57,No. 36, Washington, DC, 1992.

6. CCPS/AIChE, Guidelines for Developing QuantitativeSafety Risk Criteria, Wiley, New York, 2009.

7. EPA, Accidental Release Prevention Requirements, 40 CFRPart 68; Federal Register, Vol. 61, No. 120, Washington,DC, 1996.

8. EPA, National Oceanic and Atmospheric Administration,Aloha Users Manual, The CAMEO Software System, Wash-ington, DC, 2007.


Documents

Consistent consequence severity estimation