Quantitative Risk Assessment Under the SEVESO Directive

Quantitative Risk Assessment (QRA) Studies within the Framework of the SEVESO Directive: Implementation Issues in LOPA Analysis, FTA and ETA Analyses Our country is an important one in terms of large and very large-scale industrial facilities, particularly in the chemical and petrochemical sectors, and consequently continuously lives with the industrial accident risks that this situation brings. In the past, as in the world, our country has experienced serious fatal accidents in this regard. Awareness in our country has begun to increase with safety report preparation work for facilities under the scope of the Regulation on Prevention of Consequences of Major Industrial Accidents, known as the SEVESO II directive. Within the framework of the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, upper-tier workplaces were required to submit a Safety Report, and lower-tier workplaces a Major Accident Prevention Policy (BKÖP) to ministries by 30 June 2017. However, pursuant to the Regulation Amending the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, published in the Official Gazette dated 18 July 2017 and numbered 30127, a postponement was made to the regulation. The Regulation Amending the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, effective as of 1 July 2017, came into force on the date of its publication. Finally, the Regulation on Prevention of the Consequences of Major Industrial Accidents was reorganised and submitted as a draft regulation by the Ministry of Labour and Social Security. It is evident that many articles in the draft regulation will be changed. It is also stated in the draft regulation that circulars will be renewed. In this case, even if operators have written Safety Reports and BKÖP reports, they will have to review their reports.

Pursuant to Article 1, the phrase "1/7/2017" in subparagraph (b) of the first paragraph of Article 25 of the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, published in the Official Gazette dated 30/12/2013 and numbered 28867 repeated, has been changed to "1/7/2019".

That is, pursuant to Article 1, factories will be required to provide "the highest level of precaution possible" by 1 July 2019. The operator must reduce the frequency of occurrence of all types of consequences of each major accident envisaged for hazardous equipment determined according to the quantitative risk assessment to a level of 1x10-4/year or to a smaller level. With regard to upper-tier organisations falling within the scope of this regulation, Provincial Directorate of Disaster and Emergency Management offices are obliged to prepare or have prepared an external emergency plan taking into account the circular specified in the twelfth paragraph of Article 13, provided that it is not less than the information specified in Annex-4, Section 1 and Section 3. Pursuant to the same article, it appears that a time limit has also been given to Provincial Directorate of Disaster and Emergency Management offices for the preparation of External Action Plans. The obligation to prepare External Action Plans will begin from 1 July 2019. Provincial Directorate of Disaster and Emergency Management offices will prepare external emergency plans within 6 months from this date. Pursuant to Article 2 of the Regulation Amending the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, additions have been made to the same Regulation. Pursuant to Provisional Article 2, the provisions of Articles 10 and 11, namely articles related to Safety Report and BKÖP, will not be applied until 31/12/2018. From 31/12/2016 until the date this article enters into force, procedures conducted within the framework of Articles 10 and 11 are deemed to have no effect. In this context, protocols in which deficiencies were notified based on previously read Safety Reports will be invalidated. Within this scope, security reports submitted to the Ministry of Labour and Social Security will be returned to the organisations.

Pursuant to Article 3 of the Regulation Amending the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, Annex-1 has been amended in accordance with Regulation (EC) No 1272/2008 on Classification, Labelling and Packaging of Substances and Mixtures (CLP).

Thus, in Annex to the regulation, the R codes prepared within the framework of Directives 67/548/EEC on Dangerous Substances (DSD) and 1999/45/EC on Dangerous Preparations (DPD), which allowed for BEKRA notification, have been removed. The Directive applies to organisations containing certain hazardous substances in quantities that may cause major accident damage. An undertaking is subject to the provisions of the Directive if the storage of hazardous substances listed in Part 1 and 2 of Annex I exceeds the quantities specified in the Annex. Pursuant to Provisional Article 3 of the regulation, Article 7 of the regulation has been amended. Accordingly, notifications made within the scope of Annex-1 will be updated within one year from the date of publication of this article. In this case, companies will need to update their BEKRA notifications by 18 July 2018. This situation requires substantial workload and labour from companies. Moreover, entering correct data into the BEKRA system is important. Since the system automatically calculates the company's level in the background but does not display it to the company, the company must calculate its own level and particularly apply the aggregation rule correctly. Otherwise, it may face administrative obligations and administrative penalties within the scope of this matter in the coming year.

1.1. Quantitative Risk Assessment (QRA) Studies

Article 8 of the regulation, which explains "Quantitative Risk Assessment", has not been postponed, which has caused confusion and disorder. All organisations falling within the scope of the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences are also subject to the provisions of Law No 6331 on Occupational Health and Safety. The postponement made in the regulation was only applied to Articles 10 and 11 of the regulation; in fact, it should have also postponed other processes dependent on these articles. However, the regulation still does not clearly mention postponement. Currently, workplaces are still obliged to conduct quantitative risk assessments. This suggests that the Ministry of Labour and Social Security intends to introduce the regulation through pilot inspections. Since companies subject to the regulation are workplaces subject to Law No 6331, they are obliged to conduct risk assessments and, in the risk assessments they conduct, both comply with the provisions of the Occupational Health and Safety Risk Assessment Regulation published in the Official Gazette dated 29/12/2012 and numbered 28512, and conduct a quantitative risk assessment in accordance with Article 8 of the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences. If one of the two risk assessments is missing, work at the workplace is stopped according to Article 25/1 of Law No 6331. According to Article 8 of the Regulation on Prevention of Major Industrial Accidents and Mitigation of Their Consequences, lower and upper-tier organisations must conduct risk assessments using quantitative methods for the purpose of identifying major industrial accident hazards and assessing risks arising from these hazards.

In quantitative risk assessment, hazards that may lead to major accidents and the following aspects must be taken into account:

• Classification of hazardous chemicals, quantities of these chemicals and their mutual interactions, • Evaluation of chemical exposure in terms of human and/or environmental aspects, • Explosive atmospheres and the persistence of these atmospheres, explosive atmosphere classification and suitability of equipment to be used in these areas, • Identification and classification of hazardous equipment in the process, • Interaction between process hazards and process equipment and/or instruments, • Reliability assessment and certification of process instruments and emergency shutdown systems, • Reliability data in maintenance and repair work, • Reliability-based maintenance and risk-based control methods, • Root cause and consequence analysis of major accident scenarios, • Accidents experienced in the past and quantitative probabilities of recurrence of these accidents, • Human errors and reliability analysis. The operator must provide detailed information in the Safety Report prepared, on which data banks the reliability data used in the quantitative risk assessment and probability data used in major accident scenarios were obtained, such as maintenance records, accident analyses or instrumentation safety certification. The operator of the upper-tier organisation shall send the prepared risk assessment documents together with the safety report in digital form to the Ministry of Labour and Social Security. Furthermore, the operator must also demonstrate that with the quantitative risk assessment conducted, the highest level of precaution possible has been achieved. Pursuant to Article 9 of the regulation, the operator must reduce the frequency of occurrence of all types of consequences of each major accident envisaged for hazardous equipment determined according to the quantitative risk assessment to a level of 1x10-4/year or to a smaller level.

1.2. Implementation Issues in LOPA Analysis, FTA and ETA Analyses in Quantitative Risk Assessment (QRA) Studies

In the approach concerning the control of major industrial accidents (SEVESO Directive), there are formulations of the type "adequate protection against injuries must be provided" or "the risk in question should be reduced as far as possible". It is asked that a decision be made on what constitutes "adequate" and what does not, or which risks in particular "as far as possible" need to be reduced. At this stage, there is a difficulty both for experts who will conduct risk assessments in facilities that may cause major industrial accidents and for authorities with decision-making authority regarding these facilities: to what extent are the safety systems that can be taken in a process or system at an acceptable level. At this stage, quantitative assessments are used in many applications of risk analyses to be conducted. The probability of a particular accident occurring and the magnitude of its consequences are calculated or estimated. Thereafter, the quantitative value of the risk is used in the decision to be made on whether the hazard is acceptable or not. The most important of these analyses is the Layer of Protection Analysis (LOPA). The chemical industry has a long tradition in systematic safety work. A comprehensive summary of safety principles is given in a publication entitled "Safety Guidelines for Automated Systems in the Chemical Industry" (CCPS, 1993). The publication mentioned provided explanations both on general dimensions and on safety in automatic and process control systems. These are arranged as follows according to how they are activated against probable accidents: • Inherently safe process design, • Basic control, process alarm and operator monitoring, • Critical alarm, operator monitoring and manual intervention, • Automatic safety interlock systems, • Physical protection (relief equipment, PRV, explosion caps, etc.) • Physical protection (isolation, berms, channels, dykes, etc.), • Facility internal emergency measures, • Community external emergency measures.

LOPA is a semi-quantitative method aimed at estimating risks associated with undesired events or scenarios. It analyses whether there are sufficient measures to control or mitigate risk.

Layer of Protection Analysis is particularly used in the chemical industry when conducting process hazard analysis to evaluate whether the level of protection is adequate and to assess which protective layer or barrier is missing. It is the most frequently used method to analyse, within the framework of the SEVESO Directive, what degree of protective measures are needed against process hazards and to analyse the reliability and error probabilities of these protective layers. When we look at the situation in EU countries such as the United Kingdom, Germany, the Netherlands, France, etc., we see that LOPA is not preferred in ALARP level calculations. In most of these countries, we see that Fault Tree Analysis (FTA), Event Tree Analysis (ETA) and Bow-Tie analysis are preferred.

What is the Main Reason for This Preference?

LOPA analysis is a semi-quantitative method aimed at estimating risks associated with undesired events or scenarios. LOPA analysis, as described in the IEC 61508 series, is used to identify Independent Protection Layers (IPL). These independent protective layers may be dependent on automatic or human action. The measures called "protective layers" consist of eight levels. According to Article 3.2 of the Safety Report Circular, "In the undertaking, measures determined as a result of major accident scenarios are classified into two levels: preventive and limiting. Each of these measures is specified under the headings below as behavioural and technical safety measures. Safety measures are specified taking into account the principles of verifiability, redundancy, physical separation, independence, diversity and reliability." The rules of LOPA analysis are explained in the CCPS LOPA book and in IEC 61508 and IEC 61511 standards, and these rules are very rigid and strict. For example, let us consider a tank: suppose you have a radar-type level transmitter for high level and a fork-type level sensor as secondary to measure the level, and you stop the pump via a PLC.

When the primary high level measurement radar-type level transmitter makes an error, suppose you have the chance to stop the pump by receiving an alarm from the fork-type level measurement level sensor.

Unfortunately, in order for you to take the alarm from the secondary fork-type level sensor to stop the pump as an "Independent Protection Layer" in LOPA analysis, the primary high level transmitter that made the first error and your secondary high level sensor that measures the level must operate on DIFFERENT PLCs. Since the PLC is a common element here, independence cannot be accepted. (LOPA's rigid and strict rule) Whereas when Fault Tree Analysis (FTA) and Event Tree Analysis (ETA) are applied, Common Cause Failure (CCF) and Common Element Failure (CEF) can be calculated. Common element failure can also be calculated using Boolean mathematics with Minimal Cut Set, that is, simplified tree calculations. While LOPA analysis is pregnant with these difficulties, if FTA and ETA or Bow Tie are preferred, this time if Common Cause Failure (CCF) and Common Element Failure (CEF) are not calculated, it is stated that ALARP level calculation will not be accepted by the Ministry of Labour and Social Security. In this case, a complex risk analysis is faced, but the investment cost decreases. This is because there is an opportunity to calculate the failure of common elements and components, and despite all these failures, it can be calculated that the 1x10-4/year (ALARP) level is maintained.

2. Conclusion

The main purpose of risk analysis is to systematically identify potentially dangerous situations in a system and bring risks to an acceptable level. All dangerous situations that systems, equipment may create in their environment and to people are identified through risk analyses. However, the question that must be asked is this: Are SEVESO companies truly capable of meeting the principles of verifiability, redundancy, physical separation, independence, diversity and reliability published and explained in the CCPS LOPA book?

Industry will be in the following dilemma:

• To implement easy and not difficult LOPA analysis but provide process safety at high cost (due to Independence Principle, Redundancy and Separation Principle, etc.). • Or to apply FTA and ETA with Bow Tie analysis, in which case to undertake a difficult and complex analysis and work to explain this analysis, but having chosen an analysis that is less costly. In this case, no SEVESO company will prefer LOPA analysis knowing that it will increase costs. This will force them to Boolean mathematics, Minimal Cut Set calculations and FTA and ETA analyses. For all these reasons, there is an urgent need for a guide to be prepared by the Ministries relating to both quantitative risk assessment and the determination of ALARP level.   Özlem Özkılıç General Manager Özlem Akademi    

References 1. Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis, CCPS, 2015 2. Layer of Protection Analysis: Simplified Process Risk Assessment, CCPS, 2001 3. IEC 61025 Fault Tree Analysis (FTA) 4. Fault Tree Handbook with Aerospace Applications- eLibrary – NASA, 2002