Primatech

PT Notes

Common Mistakes in Using Risk Tolerance Criteria with LOPA

PT Notes is a series of topical technical notes on process safety provided periodically by Primatech for your benefit. Please feel free to provide feedback.

Increasingly, many companies use Layers of Protection Analysis (LOPA) in conjunction with process hazard analysis (PHA) studies. LOPA entails the use of risk tolerance criteria. Typically, these criteria are expressed in the form of risk matrices or numerically. The use of risk tolerance criteria poses numerous pitfalls. Various mistakes are common that invalidate the results of the studies. This PT Note identifies a number of such mistakes.

• Practitioners do not understand the difference between societal (group) and individual risk. This mistake can produce results that are meaningless.
• Societal risks are calculated but they are compared with individual risk criteria. This mistake can lead to more stringent risk reduction measures than needed.
• Individual risk tolerance criteria are used but without allocation to individual scenarios. This mistake leads to the acceptance of higher risks than intended.
• The number of hazard scenarios is underestimated when allocating overall facility risk tolerance criteria to individual hazard scenarios. This mistake leads to the acceptance of higher risks than intended.
• It is not recognized that the maximum number of events or scenarios to which a person might be exposed is not the same as the number of all events or scenarios that could produce the fatality of any one particular person when allocating overall facility risk tolerance criteria to individual hazard scenarios. Events or scenarios resulting in the fatality of any one particular person include not only single fatality events or scenarios but also multiple fatality events or scenarios that impact the same person. Consequently, both types of events or scenarios must be included in the number count. If this is not done, higher risks will be tolerated than are acceptable.
• Individual risk tolerance criteria are applied only to scenarios that result in a single fatality. They must also be applied to scenarios that result in multiple fatalities as both types of scenarios contribute to individual risk and assurance must be provided that contributions from both types of scenario to individual risk are tolerable. This mistake can lead to the acceptance of risks above tolerable levels.
• When allocating overall facility risk tolerance criteria to individual hazard scenarios, the maximum number of events or scenarios that result in the fatality of one particular person is confused with the number of events or scenarios that can produce a fatality regardless of the person involved, which can be substantially larger. This mistake leads to the imposition of more stringent risk tolerance criteria than necessary.
• It is not recognized that the maximum number of scenarios to which a person might be exposed may vary from one facility and process to another when allocating overall facility risk tolerance criteria to individual hazard scenarios. Risk allocation must be performed for each facility and process. This mistake leads to the acceptance of different tolerable risks for different processes and facilities.
• Risk tolerance criteria for an entire facility are used for an individual process. This mistake leads to the acceptance of higher risks than intended.
• When allocating overall facility risk tolerance criteria to individual hazard scenarios, the maximum number of scenarios to which a person might be exposed does not reflect the level of detail used to record hazard scenarios. This mistake can lead to the acceptance of higher risks than intended or the imposition of more stringent risk tolerance criteria than necessary.
• The determination of the risks for a process do not account for events that originate in other processes. This mistake results in the underestimation of risks.
• Decisions on risk reduction for people are made based only on societal risk. A facility may meet individual risk tolerance criteria but not societal risk criteria, or vice versa. For example, individual risk may be low but societal risk high if there is a large population of people exposed to the risk. Conversely, societal risk for facility personnel may be low but individual risk may be high for personnel in a process unit at the facility that contains a large amount of hazardous material. Such situations would not be acceptable.
• The concept of the tolerable frequency of all single fatalities that can occur in a facility, i.e. the group risk tolerance criterion for groups of one, is not understood. This is not the same as an individual fatality risk tolerance criterion which is the maximum tolerable frequency with which any one particular individual may suffer a fatality. This mistake produces inconsistent results.
• The same risk tolerance criteria are employed for people on-site and offsite. Usually, more stringent risk tolerance criteria are applied for people off-site so the risks for people on-site and off-site should be calculated separately.
• Risks are summed over different levels of a particular consequence type, e.g. the risks of scenarios that impact operators are summed over both fatalities and injuries. They are apples and oranges and their summation is not meaningful.
• Risks are summed over different consequence types, e.g. the risks of scenarios that impact operators and equipment are summed together. The summation has no meaning.

It is not possible to perform LOPA studies without understanding and addressing these issues. Practitioners who do not address these issues likely are wasting their time producing meaningless results.

Further information on risk tolerance criteria is provided in:

Risk tolerance criteria for layers of protection analysis, Process Safety Progress, Vol. 31, No. 2, pages 118–121, June, 2012.

Risk tolerance criteria and the IEC 61511/ISA 84 standard on safety instrumented systems, Process Safety Progress, Vol. 32, Issue 3, pages 307–310, September 2013.

Allocation of risk tolerance criteria, Process Safety Progress, Vol. 33, Issue 3, pages 227–230, September 2014.

Numerical risk tolerance criteria in the United States: A critique of the risk criterion used for the New Jersey Toxic Catastrophe Prevention Act, Journal of Loss Prevention in the Process Industries, Vol. 32, pages 428-435, November 2014.

Calibration of risk matrices for process safety, Journal of Loss Prevention in the Process Industries, Vol. 38, pages 163-168, 2015.

Setting multinational risk tolerance criteria, Process Safety Progress, Volume 35, Issue 2, pages 153–158, June 2016.

You may contact Primatech for further information by clicking here.

To comment on this PT Note, click here.

Copyright ^© 2018, Primatech Inc. All rights reserved.

Back to PT Notes