330 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) ISSN (Print) 2313-4410, ISSN (Online) 2313-4402 © Global Society of Scientific Research and Researchers http://asrjetsjournal.org/ Assessing of Feasible Independent Protection Layers (IPLs) using Layer of Protection Analysis (LOPA) for Flood Emergency Risk Management Sa’ari Mustaphaa*, Mohanad El-Harbawib aDepartment of Chemical and Natural Resource Engineering, Faculty of Engineering, University Putra Malaysia, 43400 UPM Serdang, Selangor D.E., Malaysia bDepartment of Chemical Engineering, College of Engineering, King Saud University, Riyadh, Saudi Arabia aEmail: saari@live.co.uk bEmail: mohanad_75@yahoo.com Abstract Layer Protection Analysis (LOPA) which is a risk-based approach was chosen for this purpose to evaluate the frequency and consequence to help risk decision makers for emergency risk management. Many factors have been considered in order to complete this task to achieve an acceptable flood prevention and control measures. Firstly it needs to understand the event (for this case is flood) and the local conditions, prior to mitigate the major flood. In this research first the information on vulnerable flood areas and selection of feasible Independent Protection Layers (IPLs) for flood protection. Next using Event Tree Analysis (ETA) approach, incident scenario and determined consequences were assessed for the initiating event. The undesirable outcomes of the incident scenarios was calculated by a computer software namely Lopa4flood. The developed code provide with a facility to generate scenario or sequence of events for a set of safeguards. Each scenario consists of two elements; a pair of events namely initiating event and enabling condition for starting of a chain of events followed by a series of consequence if the chain of events continues without interruption. Data for initiating event, enabling condition and failures on demand of selected Independent Protection Layers (IPLs) must be entered into the software prior to run. ------------------------------------------------------------------------ * Corresponding author. http://asrjetsjournal.org/ American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 331 The software then display the calculated frequency (per year ) of the sequence events provided with the IPLs and the consequence impact characteristic in tabular form; whether it is ‘Acceptable’ (Green color), ‘Intermediate Range’ (Yellow color) or ‘Not Acceptable ‘(Red Color) for users to make decision. The advantages of the software is rapid, easy to use and friendly, in fact it provides options of feasible IPLs and their PFDs to stakeholders to assess an optimum combination IPLs for flood prevention and control measures in flood emergency risk. Keywords: Layer of Protection Analysis; Safety Integrity Levels; Safety Instrumented System; Lopa4Flood. 1. Introduction Flood in Malaysia occurs almost every year especially during Northeast Monsoon, along the east coast states of Peninsular Malaysia namely Kelantan, Terengganu and east coast of Johor and in states of Sabah and Sarawak. Heavy rain in short period of time typically in few days is main factor to cause major flood in the areas, which also enhanced by others factors such as land clearing for agricultural activities and also due to rapid residential and industrial developments. In 1971, Permanent Flood Control Commission was established where for the first time flood warning system was implemented [1]. The flood warning system involves monitoring of water by the Department of Irrigation and Drainage (DID). As the water level reaches the warning level, the DID informs the relevant flood control centers to activate flood relief mechanism by whom the community as well as responders teams will be alerted for evacuation and relief effort. In 2014, after eight decades of enforcement of the warning system, a major flood occurred in Peninsular Malaysia that involved Kelantan, Terengganu, Pahang, Perak, Perlis and Johor. Due to the flood, 500,000 people were evacuated, 25 people were dead and costed Malaysian Government billions of Malaysia Ringgit (RM). The disaster was alarming and believed to be due to global warming. For this occasion, unscrupulous development at the vulnerable areas became a burning issue where the effected community was demanded serious attention by the regulatory. Prevention can be generally divided into two approaches viz structures and non-structured measures [2]. The structural measures include constructing flood retention dam, widening sections of river passage, building of flood protection levee, by-passing or diversion of flood ways, converting used mining ponds for flood attenuation and directing water run-off to retention and detention ponds. The non-structured measures comprise of restriction of development in vulnerable flood areas, propose land zoning, resettlement of population, establishment of flood proofing, flood forecasting , flood warning system and flood mitigation. There are two major causes to lead into a major flood which are direct and indirect causes. The direct cause is due to heavy downpour where the rain water is more than the capacity of drainage systems and rivers can take and thus, could transform into flood. The indirect cause is solely due to manmade problem such as improper logging and cleanup of land. Both causes unfortunately happened in the vulnerable area which potentially to widespread to large area. Some countries impose flood risk assessment at the risk flooding areas [3]. Flood risk is simply define as combination of the probability and the consequences of a flood event. Risk level is American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 332 determined by referring to risk matrix or LOPA [4]. LOPA method is found extensively being applied in process industry and has introduced in disaster management. Selection of specific protective layers (IPLs) is subjected to flood control measures, commonly deduce from opinions of expertises and experienced responders. Application of LOPA in flood emergency risk management is relatively new approach. The risk from a scenario is compared with risk criteria to indicate either the proposed safeguards in flood prevention and control are adequate or not. Whilst the risk criteria be based on national and international standards, regulations and government policies supported by good engineering practices/technology options and input from stakeholders. All the prevention and control measures demand a huge capital and operation costs, involvement of organizations or agencies, use of manpower and their performances appraisal. Thus, evaluation of the best technology option for risk reduction is essential to safeguard the vulnerable area exposed to extreme conditions especially during monsoon. Reliable information on the proposed prevention and control measures reflects the integrity of relevant authorities. After all, residual risk (amount of risk left after considering all feasible safeguards to reduce all the risks) is required to screen further and its consequences will be determined by calculation or simulation. Major floods in Malaysia were recorded happened in 1931, 1947, 1957, 1967, 1971, 2007, 2010, 2012 and 2014 where the disasters occurred during North East Monsoon from October to March every year. For period 1961 to 2006 data of flood frequency in Kelantan was indicated that the water levels were reached to dangerous levels in the amount of 23 times [5]. It was anticipated that constructing of Kemubu and Lebir dams might reduce forty percent of the impacts. Further flood reduction could be achieved by constructing the proposed levees at both sides of riverbanks of Sungai Kelantan at segments from Tanah Merah through Pasir Mas to Kota Bharu [6]. As said, risk of flood cannot be totally disappeared although the structure and non-structure flood prevention in place. Thus, the structure and non-structure flood prevention later called IPLS must be continuously reviewed and updated by consulting with experties and authorities. Consequence is defined in terms of losses of life and property, where their sizes and tolerance limits are referred to related organizations. Losses such as injuries and fatalities of people, damage to the environment, or financial losses are terms used to express the target risk levels. Determination the consequence is result from computation the proposed safeguards (IPLs) to reduce flood risk. This paper discusses a friendly tool (LOPA) was developed where users can key in the data of a initiating event into a software and configure a number of Independent Protective Layers (IPLs) which facilitated as an option users. Result from simulation could help to assess risk level and thus, might improve an existence of flood risk emergency management. 2. Methodology LOPA includes the method that falls between qualitative and quantitative methods. There several steps involve in developing this analysis. Below is the summarization of the steps or methodologies that to be used in the whole project: Step 1: Identification of the consequences to screen the scenarios Step 2: Selection an accident scenarios American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 333 Step 3: Identification the initiating event of the scenario (flood) and determine the initiating event frequency (events per year) Step 4: Identification IPLs and estimatation the probability of failure on demand of each IPL. Step 5: Estimation risk of the scenarios by mathematically combining the consequences, initiating event, and IPL data. The overall activities using LOPA method is depicted in Figure 1; Figure 1: Flowchart of Activities in LOPA Method Step 1: Identifion the consequences to screen the scenarios In LOPA, consequences are estimated to an order of magnitude of severity. The consequences are the undesirable outcomes of accident scenarios There are various types of consequence analysis used in LOPA such as effect flood to life’s, property, environment and community. The organization involved which flood relief e.g. Responder team with its resources requires to estimate the consequences of flood to community and its should be done with attentive evaluation. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 334 Step 2: Select an accident scenarios A scenario is an unplanned event or sequence of events that results in an undesirable consequence. Each scenario consists of at least two elements: i. An initiating event that starts the chain of events ; ii. A consequence that results if the chain of events continues without interruption; iii. Enabling events or conditions that have to occur or be present before the initiating event which yield a consequence; iv. The failure of safeguards (which may be IPLs). Once a scenario has been identified, it must be developed and documented to the level where a basic understanding of the events and safeguards is achieved. The scenario may not be initially understood completely and may undergo revisions. Once the initiating event is identified for a specific scenario, the analyst must determine whether any enabling events or conditions are required for the initiating event to lead to the consequence. The next step is to confirm that the consequence is stated using the same criteria as the LOPA method. Step 3: Identify the initiating event (flood) and determine the initiating event frequencies (events per year) For LOPA, each scenario has a single initiating event. The frequency of the initiating event is normally expressed quantitavely of events per year. The initiating events, should be reviewed, verified as validated initiating events of the following consequences. Any causes that are incorrect or inappropriate should be either discarded or developed into valid initiating events. This step covers searching of source of frequency data, selection of failure rates, derivation of initiating event frequency from failure data, time at risk, adjustment of frequency rates and high demand mode. Major floods have very low frequency compared to smaller floods which occur more often. If it occurred every year, its annual probability is 1.0 and thus, the probability 0.1/year for the disaster happens every 10 years. Step 4: Identify the IPLs and estimate the probability of failure on demand of each IPL. An IPL is a device, system, or action that is capable of preventing a scenario from proceeding to its undesired consequence independent of the initiating event or the action of any other layer of protection associated with the scenario. In order to be considered an IPL, a device, system, or action must be: i. Effective in preventing the consequence when it functions as designed, ii. Independent of the initiating event and the components of any other IPL already claimed for the same scenario American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 335 iii. Auditable; the assumed effectiveness in terms of consequence prevention and PFD must be capable of validation in some manner. The basic requirements of effectiveness, independence and audit ability for an IPL are determined by several methods. The simplest is to use a written design basis, or IPL summary sheet, which must be available for review by the LOPA team or analyst. Netherland set safety standards to protect areas against flood by a series of water defenses (dikes, dunes, hydraulic structures) and high ground [7]. Depend on locations of flood prone areas the values in between 1/10.000 per year to 1/1.250 per year. According to US Army Corps of Engineer [8] failures of flood protected layers can be considered approximately 1 in 10,000 years. Negative emotions induced by flood disaster was found to be key factor for raising motivation of community to participate in risk management [9]. From internal communication with Department of Fire and Rescue Malaysia which responsible in arrangement of evacuation and rescue of flood victims, the community has given good cooperation to the response teams and thus, IPL for evacuation and shelter can be considered as 1.0. Step 5: Estimatation the risk of the scenarios by mathematically combining the consequences, initiating event, and IPL data The following is the general procedure for calculating the frequency for a release scenario with a specific consequence by following equation, 𝑓𝑓𝑖𝑖𝑐𝑐 = 𝑓𝑓𝑖𝑖𝐼𝐼𝑥𝑥 �𝑃𝑃𝑃𝑃𝑃𝑃𝑖𝑖𝑖𝑖 𝑖𝑖 𝑖𝑖=1 = 𝑓𝑓𝑖𝑖𝐼𝐼𝑥𝑥 𝑃𝑃𝑃𝑃𝑃𝑃𝑖𝑖1𝑥𝑥𝑃𝑃𝑃𝑃𝑃𝑃𝑖𝑖2𝑥𝑥… … . .𝑃𝑃𝑃𝑃𝑃𝑃𝑖𝑖𝑖𝑖 Where: fi C is the frequency for consequence C for initiating event i fi I is the initiating event frequency for initiating event i PFDij is the probability of failure on demand of the jth IPL that protects against consequence C for initiating event i. The Equation is applicable for low demand situations that is, fi I is less than twice the test frequency for the first IPL. Step 6: Making Risk Decisions Three basic types of risk judgment are used in conjunction with LOPA: i. The predominant method is to compare the calculated risk with predetermined risk tolerance criteria through use of various methods; ii. The second type is expert judgment by a qualified risk analyst; iii. The third type is relative comparison among competing alternatives for risk reduction, using either of American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 336 the methods described above. Risk determination (frequency of consequence versus consequence category) from predetermine scenario will be judged based on risk tolerance criteria. The result is presented in three categories which are acceptable, not acceptable or fall in between the regions ( intermediate) as depicted in Table 1. Table 1: Risk Tolerence Criteria (J Ramseh Babu) [10] Frequency of Consequence Consequence Category Category 1 Category 2 Category 3 Category 4 Category 5 100 – 10-1 10-1 – 10-2 Not Acceptable 10-2 – 10-3 Intermediate 10-3 10-4 Range 10-4 – 10-5 10-5 – 10-6 Acceptable 10-6- 10-7 The consequence category was presented in Table 2 which is a slightly adjustment of the level ( US Army Corp , 2012). Table 2: Consequence Category of Flood Impacts Level of Category Definition Category 1 No significant impacts to downstream population other than temporary minor flooding of roads or land. Category 2 Limited property/environmental damage. Although life-threatening flows are released and people are at risk, life loss is unlikely. Category 3 Moderate property/environmental damage. Some life loss is expected (1 to 10). Category 4 Significant property/environmental damage. Large life loss is expected (10 to 100). Category 5 Extensive property/environmental damage. Extensive life loss is expected (> 100). In making more accurate risk decision, stakeholders must consider all scenario options and properly analyze by LOPA approach. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 337 3. Lopa4Flood Software The Lopa4Flood software was developed to analyze and assess risk through semi-quantitative methods. The software enables users to add protection layers (IPLs) to be analyzed for flood protection . With provision predetermined risk criteria the users can make comparison with a set of chosen protection layers (IPLs). Accuracy of IPLs frequencies are critical in the calculation because they will be used to determine the outcome of the simulation. The data of frequencies usually obtained from historical failure rates, the regulatories and expertises. Results can be promptly obtained after completing the input in the program. Followings are the steps to input the data:- i. Develop a scenario of flood with a set of selected safeguards or protection layers (IPLs), ii. Insert frequency data of initiating and eabling events iii. Insert the frequencies for selected IPLs . iv. Click the ‘NEXT’ button after completing the above inputs. If result shows ‘Acceptable’ , then there is no need to add more IPLs. However if the risk simulated are ‘Unacceptable’ or ‘Intermediate’, it is chance to analyse further by adding more IPLs until the result simulated become ‘Acceptable’. 3.1 Lopa4Flood Web Application Lopa4Flood is a web application to evaluate and analyze the risk tolerance for Layers of Protections for flood situation. The web application helps to estimate the consequences cost of possible damages caused by flood in a fast and reliable way. The application supports all devices such as desktop, tablet or smartphones running on any modern web browsers on any operating systems such as Google Chrome and Mozilla Firefox. The codes are built using HTML5 and JavaScript language. 3.1.1 Designing the application HTML5 is a markup language used for structuring and presenting content on the World Wide Web. It is the fifth and current version of the HTML standard. JavaScript (JS) is a lightweight, interpreted, programming language with first-class functions. JavaScript is most well known as the scripting language for Web pages. HTML5 and JavaScript were chosen because they are supported on all kind of operating systems running on any devices. The codes, which were uploaded to a web server, are accessible to users by accessing the URL www.lopa4flood.com 3.1.1.1 Building the Graphical User Interface (GUI) The design of the GUI is based on the markup language (HTML). For this application, a few HTML forms American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 338 element are used such as input field (text box), and button. For the results view, HTML tables are used. HTML is also used to develop LOPA4Flood as front-end (GUI) and simulate the Consequence Estimation based on the Layers of Protections in the back-end. The computation of the Consequence Estimation based on the Independent Layers of Protections (IPL) data has been written in JavaScript. GUI is very to use and the users can perform the Layers of Protection analysis by filling in a few input fields such as PFD of Initiating Event, PFD of Enabling Event and Independent Protection Layer(s). User can proceed to compute the Consequence Estimation by clicking the “Next” button. 3.1.1.2 Input Interface This interface contains various input fields for user to fill in. The user will be required to enter at least three mandatory fields: i. Probability of Failure (PFD) on Demand of Initiating Event ii. Probability of Failure (PFD) on Demand of Enabling Event iii. At least one Probability of Failure (PFD) of Independent Protection Layer (IPL) The users can fill in up to 6 PFD of IPLs. Figure 2 shows the input fields mentioned above and examples of the value to be keyed in. Figure 2: Main Front Page Lopa4flood 3.1.1.3 Output Interface After the application performed the computation to estimate the consequence cost, the results for the American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 339 consequence estimation will be displayed in tabular format. The application will display the frequency of consequence per year and the consequence Impact / consequence characteristic as listed below: i. No significant impacts to downstream population other than temporary minor flooding of roads or land ii. Limited property/environmental damage. Although life-threatening flows are released and people are at risk, life loss is unlikely iii. Moderate property/environmental damage. Some life loss is expected (1 to 10). iv. Significant property/ environmental damage. Large life loss is expected (10 to 100). v. Extensive property/environmental damage. Extensive life loss is expected (> 100). Based on the Consequence Impact/ Consequence Characteristic, the application will show whether they are Acceptable (Green color), Intermediate Range (Yellow color) or Not Acceptable (Red Color). Figure 2 shows the example of the results for Frequency of Consequence / Year of 10^-0. Figure 2: Output of Lopa4flood Case Study Safeguards for control major flood are divided into structural and non-structural measures. Structural measures included dams, levees, embankments and concrete wall, retention detention ponds and diversion. Non- structural measures are river improvement, gazetting the reserve forest, pond and emergency response plan. The non-structure measures can be considered one IPL or separately for each measure. All the proposed measures involve capital and operation costs, and need careful determination by the authority, organisations or agencies, and other stakeholders because they liable to huge government budget or expenditures for the construction and operation. Residue hazards then further to be screened, their consequences will be determined American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 340 by calculation/simulation by Lopa4flood. The proposed IPLs is presented in Figure 3. Figure 3: Proposed LOPA for Flood Prevention and Control LOPA scenario chain for the proposed safeguards is showed in Figure 4. Figure 4: LOPA Scenario An extreme rain is initiating event with enabling event to cause a major flood. A designed flood prevention system or SIL to maintain the vulnerable area to the safe region. There are seven Independent Protection Layers (IPLs) are proposed. User has given option to either to consider single IPL or multiple IPLs for the prevention analysis. First protection layer i.e. dam inherently safe. Safe design, if properly implemented can significantly reduce the frequency of consequences associated with a scenario. Generally, all structures in flood American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 341 prevention are safely designed. For time being the measures are consider safer design and thus for calculation their frequencies are 0.1. Therefore, 0.9 is the frequency if the design is not properly safe. The frequencies of iniating event and enabling condition are considered 0.1 because major flood event in average occur every 10 years. Risk of the flood scenario was simulated by Lopa4Flood and it was generated essentially from risk criteria as shown in Table 2. Figure 5: Input and Output of Lopa4Flood 4. Conclusion Lopa4flood software has been developed to determine the SILs for flood emergency risk management using LOPA method. The methodology provided by LOPA was useful in achieving the risk decision making. The decision process was made by comparing the calculated scenario frequency with the risk tolerance criteria. Furthermore, LOPA has resolved unwanted conflicts in decision making by giving flexible arrangement of IPLs for estimating the consequences of the scenario. Lopa4flood is user’s fingertips for simulating flood scenario and rapid in obtaining result. It provides options to feasible feasible IPLs and their PFDs for minimizing the risk levels and in fact could satisfy the stakeholders and authorites in determining SILs for Flood Emergency Risk Management. Acknowledgement The authors would like to thank Ministry of Higher Education (MOHE) for awarding a PGRS grant, Research Management Centre, Universiti Putra Malaysia and and Program of Flood Disaster Management, MOHE for their support. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 26, No 4, pp 330-342 342 References [1] Nizam Yatim, Mengimbau Bah Besar 1926, 1971 Utusan Online.(January, 2007) Laporan Khas., 15/01/2007. [2] Thampapillai, Dodo J., Musgrave, Warren F, Flood Damage Mitigation , A review of Structural and Unstructural Measurements and Alternative Decision Network. Water Resources Research, Vol 21, Issue 4, 44-424, 1985. [3] E. Mostert and S. J. Junier . The European Flood Risk Directive: Challenges For Research. Hydrology and Earth System Science Discuss, 6, 4961–4988, 2009. [4] Mohanad El-Harbawi1, Zatil Azhani Bt. Razali1, Sy M Faiz B Sy M Fuzi2 and Sa’ari Mustapha. Using Layer of Protection Analysis (LOPA) to Determine Safety Integrity Level (SIL) in the Process Industries.Journal of Applied Science, 10(24), 3310-3324, 2010. [5] Tuan Pah Rokiah Syed Hussain and Hamidi Ismail . Flood Frequency Analysis of Kelantan River Basin, Malaysia World Applied Sciences Journal 28 (12): 1989-1995, 2013. [6] UPEN. Draft Laporan Tebatan Banjir Menyeluruh Bagi Kawasan Limbangan Negeri Kelantan. 1989 http://repository.wwf.org.my/GovernmentReport/LapuranKajianTabatanBanjirMenyeluruhBagiKawas anLimbanganSungaiKelantan.pdf [March, 15, 2016] [7] Sebastiaan N. Jonkman, Matthijs Kok, and Johannes K. Vrijling. Flood Risk Assessment in the Netherlands: A Case Study for Dike Ring South Holland. Risk Analysis, Vol. 28, No. 5, 2008. [8] US Army Corps of Engineer. Best Practices in Dam and Levee Safety Risk Analysis. Reclamation Managing Water in the West , 2012. https://www.usbr.gov/ssle/damsafety/risk/BestPractices/Chapters/I-0-20150612.pdf [March, 15, 2016]. [9] Matthias Buchecker, Dominika Maria Ogasa, Elisabeth Maidl. How well do the wider public accept integrated flood risk management? An empirical study in two Swiss Alpine valle. Environmental Science & Policy 55 ,309–317, 2016. [10] J Ramseh Babu. Layer of Protection Analysis – An effective tool in PHA. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.522.1335&rep=rep1&type=pdf, [Feb, 3,2016] http://repository.wwf.org.my/GovernmentReport/LapuranKajianTabatanBanjirMenyeluruhBagiKawasanLimbanganSungaiKelantan.pdf http://repository.wwf.org.my/GovernmentReport/LapuranKajianTabatanBanjirMenyeluruhBagiKawasanLimbanganSungaiKelantan.pdf https://www.usbr.gov/ssle/damsafety/risk/BestPractices/Chapters/I-0-20150612.pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.522.1335&rep=rep1&type=pdf