DOI: 10.3303/CET2291018 Paper Received: 14 January 2022; Revised: 23 March 2022; Accepted: 25 May 2022 Please cite this article as: Schmitz P., Swuste P., Reniers G., Van Nunen K., 2022, Linking Barrier Indicators to Major Accident Scenarios, a first Step to Predict Major Accident Scenarios, Chemical Engineering Transactions, 91, 103-108 DOI:10.3303/CET2291018 CHEMICAL ENGINEERING TRANSACTIONS VOL. 91, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-89-1; ISSN 2283-9216 Linking Barrier Indicators to Major Accident Scenarios, a First Step to Predict Major Accident Scenarios Peter Schmitz a, Paul Swuste b*, Genserik Reniers b, Karolien van Nunen b,c aOCI-Nitrogen, Urmonderbaan 22, 6167 RD, Geleen, the Netherlands bSafety and Security Science Group, Technical University of Delft, Jaffalaan 5, 2628 BX Delft, The Netherlands cResearch Chair Vandeputte, University of Antwerp, 2000 Antwerp, Belgium paul@pauswuste.nl At the OCI Nitrogen ammonia plant, located at the Chemelot site in Geleen, The Netherlands, a project has been initiated to monitor major accident processes at the site. This contribution answers the question whether indicators can be derived from the barrier system status to provide information about the development and likelihood of the major accident processes in the ammonia production process. The accident processes are visualized as scenarios in bowties. This research focuses on the status of the preventive barriers on the so called ‘left-hand side’ of the bowtie, before a hazard becomes uncontrollable. Both the quality – expressed in reliability/availability and effectiveness – and the activation of the barrier system give an indication of the development of the accident scenarios and the likelihood of the central event. This likelihood is calculated as a loss of risk reduction compared to the original design. The calculation gives in an indicator called “preventive barrier indicator”, which should initiate further action. Based on an example, it is demonstrated which actions should be taken and their urgency. 1. Introduction Identifying process safety indicators of the ammonia production process and providing information on major accident processes is a challenge. The starting point is the ranking of the most dangerous process parts (Schmitz et al., 2020). Completed with major accident scenarios of ammonia plants internationally, a selection of most likely, hazardous scenarios has been determined. This study describes the results concerning indicators to recognise and stop the development of these “worst credible” scenarios at an early stage. The research question is: Can indicators be derived – based on the status of the barrier system – that provide information on the development and likelihood of major accident processes in the ammonia production process? There is little empirical research published on process safety indicators, but many (petro)chemical companies measure their process safety performance. Often, a distinction is made between 'leading' and 'lagging' indicators. Where the former are proxies to hazards, barriers, scenarios and management factors, the latter provide information on the loss of containment or loss of control events and their consequences. The scientific literature questions this distinction (Swuste et al., 2016, 2019). 2. Materials and methods The bowtie model of accident processes is used in this study, starting with one or more hazards at its left side (Visser, 1998). A hazard represents an energy, e.g. a chemical substance, or an overpressure (Figure 1). Arrows represent different scenarios which will lead to a so-called central event, a situation where a hazard becomes uncontrollable. Barriers placed in the scenario pathways can prevent a central event from happening. 103 Barriers are generally classified in physical and non-physical barriers, and are usually made up of three elements: a sensor, a decision maker and a final element or action taker (Guldenmund et al., 2006). A barrier only works if all three elements are functioning, and can be regarded as a 3-out of-3 system. Figure 1: The bow-tie model (Visser, 1998) The quality of a barrier is determined by various parameters, including: 1/ trustworthiness (effectiveness: functionality, reliability: performing its function, availability: functioning at any point in time), 2/ costs to keep the barrier functional, reliable and available, 3/ robustness: continue to function during incidents, 4/ response time: the time from activation to the execution of the intended function, and 5/ ‘’trigger": the event or condition that activates the barrier. To measure the likelihood of a scenario to develop into a central event, the decline in quality of the barriers must be monitored. The quality parameter trustworthiness is regarded as the only one that will vary sufficiently over time and can present the possible deterioration in quality of a barrier. Preventive and corrective maintenance, inspection and test programs, and management and administrative aspects influence the trustworthiness of technical barrier systems. Sometimes a barrier is deliberately inactivated, or overridden, for example, for performing maintenance, an inspection or a test. So the status of a barriers may differ as Table 1 shows, including related symbols, used as abbreviations in this paper. Table 1: Possible barrier statuses and associated symbols Barrier status Barrier symbol Trustworthy and not activated Not maintained, inspected or tested on time V Possibly not trustworthy ? Not trustworthy Overridden or defective Θ Trustworthy and activated ! Trustworthiness of a barrier and risk reduction can be calculated, using a common and generally accepted equation from the IEC (2016) of the unavailability of a barrier as a function of time: U(t) = 1 - e-λt, where λ is the barrier failure frequency and t is any moment in time. U(t) is a dimensionless number between 0 and 1, a barrier is 100% trustworthy when the barrier is new. U(t) increases as time progresses. If a barrier is never maintained, inspected and tested, and the time t runs to infinity, U(t) will go to 1, the barrier will fail with 100% certainty when it is needed and/or the barrier will not (correctly) perform its necessary function. The risk reduction RR that can be achieved with the barrier is the reciprocal value of U(t), RR equals (1 - e-λt)-1. The risk reduction is mostly given as a 10-, 100- or 1000-fold reduction. The risk reduction expressed in logarithm is abbreviated as RRL, where the RRL is equal to log(1 - e-λt)-1. In this study the time interval in between each maintenance, inspection and test is defined as T, meaning the barrier is maintained, inspected and tested at T, 2T, 3T, etc. The barrier can be qualified as trustworthy if it is checked no later than the required period T. If it is checked later than the required period T, the RR will decrease below its designed value. Table 2 shows the effect of postponement of maintenance, inspection and testing on the risk reduction RR and the risk reduction expressed in logarithm RRL. Three different values of U(t), meaning 0.1, 0.01 and 0.001, are included in Table 2 for various time intervals. An unavailability of 0.1 means that on average, the barrier is not working in 10% of the demands. Table 2 shows, for example, the effect of a postponed check by half a period to 1.5T. U(t) increases by a factor of 1.5 to resp. 0.15, 0.015 and 0.0015 and the RR decreases by 33%. In this study, it is assumed that a barrier may not be trustworthy if the RR has decreased by 50% or more from the required design value. Table 2 shows that this is the case if a barrier has not been checked (maintained, inspected and tested) for more than a doubled period of T (from 2T upwards). 104 Table 2: The influence of the time interval on U(t), RR and RRL Time interval T U(t) = 1 – e-λt RR = (1 – e-λt)-1 RRL = log(1 – e-λt)-1 T 0.1 / 0.01 / 0.001 10 / 100 / 1000 1 / 2 / 3 1.5T 0.15 / 0.015 / 0.0015 6.67 / 66.7 / 667 0.82 / 1.82 / 2.82 2T 0.19 / 0.019 / 0.0019 5.25 / 52.5 / 525 0.72 / 1.72 / 2.72 2.12T 0.20 / 0.020 / 0.0020 5.01 / 50.1 / 501 0.70 / 1.70 / 2.70 3T 0.27 / 0.027 / 0.0027 3.69 / 36.9 / 369 0.57 / 1.57 / 2.57 3.66T 0.32 / 0.032 / 0.0032 3.16 / 31.6 / 316 0.50 / 1.50 / 2.50 6.58T 0.50 / 0.050 / 0.0050 2.00 / 20.0 / 200 0.30 / 1.30 / 2.30 No check 1 1 0 The status of the barrier system determines the likelihood of the central event against which the barriers should prevent, and is therefore a suitable indicator. The preventive barrier indicator is the quotient of the current RRL and the required RRL. This is also called relative risk reduction expressed in a logarithm: RRRL. RRRL(t) = [RRL(t) / RRLrequired] x 100%. Table 3 shows the outcome of the preventive barrier indicator representing the likelihood of the central event in four colours. This likelihood increases as the colour shifts from green to red. The boundaries are evenly distributed in this chapter and are set at 0%, 25%, 50%, 75% and 100%. For each of these classifications, management must determine how to respond and by whom. Table 3: The colour of the preventive barrier indicator related to the RRRL 100% 75% 50% 25% 0% RRRL RRRL>75% 50%< RRRL ≤75% 25%