SIOP Maleials 8 Caroston Engneering Maraven Cardon S1Norkshop 1996 Determining Criticality A Qualitative Approach by Wim Verstiinen Issue Bowtie Model x OORDNDE omozmcomozoo hs document it vested wih Shell international Oi Product 8V,, The Hague, the Nethedends od he whole nor any Dart of thir document oF sof teitiaval ayatem oF in eny forrn or by any means (electronic, ‘therwise| without the prio written consent of the copyright onneeSIP Materials & Conesian Encinsering Maraven Carden Si: Workshos 1996 Contents i _ 1 Introduction 4 1.1 Criticality 3 12 Basis of Design, Plant Condition and Operating Practice 4 2 Determining Criticality i 24 General 4 2.2 Analysis of the Likelihood of « Failure G 2.3 Analysis of Consequential Damage of a Failure 5 2.4 How to Determine Criticality? § 2.4.1 Ranking of Consequence (of failure) 6 Table 1. Ranking Consequence of failure. 7 2.4.2 Ranking of Likelihood (of « failure) 8 Table 2. Ranking of Likelihood 8 2.5 Flowcharts and Tools for assistance 10 Flowchart 1: Primary Evaluation of Plant 10 Flowchart 2: Bow-tie Model Likelinood & Consequence Model n Flowcharts 3A and B: Consequence of Failure; Release of Process Medium R ‘Table 3: Consequence of Failure; Production Loss and HSE 13 Flowchart 4. Likelihood of Corrosion and Degradation. 14 Table 4: Severity Risk Estimator Matrix 15rosen Engineenng graven Cardon Si-Werkshep 1995 1 Introduction ‘The abjestve ofthis document is t0 provide some assistance in determina the entcalir ofa lant, gestions ofa plant or individual plant equipment or piping. Without a play or ‘guidance one may get easily trapped in the complexity of the subject, which will 4 “qualitative risk assessment" study. Ikely slow dowa the 44 Criticality Caiticalty is generally defined a5 the product of Likelihood (risk) and Consequence of a failure (Criticality = L x C), Instead of likelihood, risk or predictability ofa failue are also often used, Likelihood seuns to be more appropriate Note: A failure should be seen as a general break-down of equipmen: ara! or piping. Ina Corrosion Loop - Selecive Inspection study somewhat more emphasis will be ven io corrosion failures and failures becouse of other material degraclaiion mechaniuns, Many catastrophne failures have been caused by material degradation of sone lant Crticality is commonly presented in a matrix format. These matrives have in common that on one axis “Consequence” is shown and on the other axis "Likelihood" Cnicality. the combination at ‘he evo, is determined in the matrix by the cross-lines of L and C. The rish-upper comer of euch 2 matrix will rate a very high criticality, while the boxtom left comer, diagonally opposite has a set) low entcaly. See figure 1. Operating inthe extreme high criticality region sll always be avoided. A ctitcaity analysis will enable to determine the selativecitcalities benwn various parts of the production process and related plant hardware (equipment, piping) In priziple the intial goal is to Getermine the relative criticalites (high-low ranking order) in a plan Current inspection and monitoring practices can than be adjusted and a "Selective Inypoction and Monitoring Programme” tailored to criticality. The following shows how likelihood and consequence can (or can not) be affected. ‘The likelihood of s failure can be reduced by for instance, * selective hardware inspection or more frequent inspection of critical ems + contrelling the corrosion mechanism by means of contrline process parameters * avoiding corresion or changing failure mode (brittle versus ductile fa lure) Corrosion can be aveided by upgrading of the materials for instance or by enntrolling corrosive Conditions in the process. In some cases a problem can be fully designed out e ¢ when incoloy 825 is applied in stead of stainless ste, to avoid chloride stress covresion cracking. Hates the Ukelinood, and terefore the consequence, of such a failure does not nced to be considered any more (Likelihood = 0) The consequence of failures can be more difficult to reduce, because of © (old) existing plant design, © existing ncighbouring plants (layout), ‘+ ploperties and volumes of products hand! ‘+ snisting environment around the plant (popuilated or environine itive areas)SHOP Materials & Gettsion Engineering i 8 Caton S.Werkenep 1c0¢ Actions in the following arcas are commoniy be taken to reduce risk aid prevent severe consequences: * reduce the amount of personnel present in'an area, * early waming systems (eg. H2S alarmvbeepers) to ensure personnel is evacuated in time, % 2nd containment or extra distance (e.g. LPG spheres, si © fire fighting systems which can contain the "problem and . taliation of ROVs to close-in volumes, to limit potent © special protective functions ‘These amongst other measures are applied in pl Sand are nonnally. updated for older plants by’ means of the results of (safety) studics Note : For a full onalyses of eriicaluty a quantanve risk anolvsis (ORA) is reyntved. A ORA mey-acest Jn comparing risks ono (inore) equal basis ard in more detail. This may he uci for cero plants or part of plants as a follow-up study. OFA studies have hinvever xreat dieu to grasp material degradation and corrosion phenomena thar miay lees 10 a foilnre onl sig Process parameters behind it QRA is generally based on global and "ala" data scrher thea plant specific data 1.2 Basis of Design, Plant Condition and Operating Practice {eis important to realize chat plant and processes are designed according certain standards. Iu Corrosion Loops/ sclecitive inspection studics itis essumed that. © the plants des practices, the plant is operated and maintened properly, the plant satisfies Shell, Local and Industry standards (BS. the plant fulfils general requirements regarding safety, integrite and operability igned according to commonly accepted design and enginvcring Hence the criticality and/or integrity of a plant or process is assumed to asi. ifthose basic requirements are not fulfilled it ean not be assumed that the plant o in safe manner accordine to eneinecring standards. The corrosion loup study can still br Xccuted but the maximum level of criticality may’be beyond the acceptance limit and ths sty should fulfil more than 2 plant optimisation excercise, 2 Determining Criticality 24 General Critical areas are identified by studying, analysing and quantifying the (potemtial) degradation ‘mechanisms that can affect hardware and cause failure Subsequently the consequetice ofthat possible failure shall be detsemined, In order to make proper screening and ranking of crticallics it is important to breakdown and consider the separate elements that determ, Likelihood and the Consequence of failures ‘The analysis of likelihood and consequence shall be carried out in a study-senvcning exercise with Professionals in the ficlds of Technology, Corrosion, Inspection, Operation and Mamrunares A Seed understanding of the plant and “local” operating practices is required, in ordcr 1o arrive at a Proper criticality ranking. nitieality vizSIOP Materiais 6 Coresen eng Maraven Gaiden Si-Workshop 1968 2.2 Analysis of the Likelihood of a Failure Likelihood of a failure is a function of. Qu n basis: "designed and built according to appropriate standards" Current plast/2quipment condition, Quality of maintenaneeinspection, ‘Type of process and process control, Potential degradation mechanisms, ‘The rate and nature of degradation, Amount of equipment pron 10 "risky" degradation mechanisms: Quality of managing the aforementioned points 23 Analysis of Consequential Damage of a Failure re is.a function of: Consequence of * Potential Release Volume that can be releated and rate of release fiction of hole size, pressure and volume: Px Vx "Hole Size" = Release * Properties of released medium: ability to inflame - to Nash - to ignite to explode = to poison - to harm * Chance of ignitiowexplosion etc. once escaped * Damage potential: injuries and fatalities, hardware replacement co: loss, environment damage/repair, * Business damage: time out of operation, loss of "goody image, eaviroamentel, + Escalation/inock-on effects: tendency to develop fiom minor to serious eenditions other plants not receiving feed stock, etc. * —Deescalation! containment: containment by means of bungwall or sprinklers fire fighting systems, ROVs, ESD, early waming systems, . production company 2.4 How to Determine Criticality? AS by 5 Criticalty Mats is advised for erticaity ranking. Thisis im ine with what many thers use to assess enriclity, including Shell Safcty depacumenl, DNV/API. In arer to reduce the tendency for mathematical abuse of the matrix (LxC), itis also edvised to rate the Consequence classes in letters from A, B, C, D to E and the Likelihood fram class 1, 2,3, 4 10 4 as indicated in figure 1 below, rather than using figures for both,SOP Materiae & Corrosion Engineering _ siisehcoete Sisters Consequence of Failure Man Criticality Matrix Fiz. t | macaiity Matrix Fist Column £5 is the worst case scenario, high consequential damage (E) eonibined with a high liketitiood (5) For instance 2 total burn-down of a major unit would fall in this eategory: A is lowest score indicating a very low likelihood with very low consequential damage. ¢ 2 ¢rain 0° supply line, Level 5 for likelihood should be Predictability". tical water nterpreted as "likely to cceur” or To obtain a sense and a reference of criticality aking of CLonps, vari Plants or parts thereof ean be cempared to each sther 1) processing Remark: CDUs are generally not considered 10 be “dangerons" plans, nian cruce ditions have een operated safely for many yeers. On the other hamid most of the sion netrceny Processes depend on the unit for feedsiack. Hence, provided hat o 14 disruption of operations dees not occur, ene might consider tho the entculay ofr C10 shendd rank below thal of far instance rackers. The safety aspect: ofo CIM een Also be consicicred 10 he relatively low when compared twHCUs of 6 for incignee Hh alkylation and SWS watts where large 1 af tote mederictl (HE H28) 1 possible The safety risks are here reduced by means uf specifie measures us if 2% storms “restricted area”. leng-reray 24.4 Ranking of Consequence (of failure) Itis suggested to separate HSE issues from production deferment and capital loss of facilities ‘The following table 1 indicates this by means of "HSE" and "CAP" colunns be casier When itis allowed to deal with both categories separately The consequence table I of starts with the worst case scenarios, eategory El cads with low consequence category A at the bottom ofthe list A letter in the cohums. HST or CAD. anans Tower class than indicated for tht column, an *X" mark confirms equal to cla catcgorSIOP Matern § Coren Maceven Cargon SWerkston 1908 Table 1. Ranking Consequence of failure. Note 1: The table bclow is intended as an example only Note 2: "X" mark in "HSE" or “CAP” colunm means same level as indicated Class lenters indicate relevant fower class Class | Consequence of Failure HO] C] Remarks ABCDE | Classification & Comparison List |S | 4 Examples Elp Class] Large release of LPG fiom Sphere x [C | Cansiracions are relaive ireapeaane because of fracture, Storage is oft few reniote From operating facilities: Containment can neve it down to class D or C ‘HF-Alkvlation, AF release x |] Light HC producis released + ven tows | HE, Fire destroying tain CDU; large |'D| x | To.al/Partal dimaption of winery | Jeak in botiom line, gasoil strippers, possible: Examples: failure of transferiins. transfesline, Bolton: line. yasoil strippers etc? Depends on size of Teale Class D | Large Volume of Hot Oil Preducis [x |x | Could be E deponds an So-win oF danaar ‘Above flash point? Fire: eg CDU expected column. botloms, side strippers Tight product release above X | | Could be E depsnds on sey of @ammge Sashpoint Fie’ Explosion? CDU expected Side strippers? Failure OVD Tine CDU: *Fire |x |x | Large hole duc io wall aiming, ain hole likely ul ‘Total Failure of all or non-spared |B | x | Production loss when to shod lerur Ree¢pumps replacenisnt is possibic, No escalation. D - Plants? Loss of ron-spared-non-casyto |B [x | Produton loss whavna onan replacable equipment replacement is possible. No escalation DS Plants? Class © | Smale: quantities of wealeases [S| x | Assuming eednion ube pacuial fromD and Release of Acidsand chemicals, [= | B | Move nak for nan Dogan (causiie, HCL, ).¢g, Acid dosing equipment. however ewstic cracking!!! Line slurs | Failure of non-spares HE tabeside | A | x | Some HE appear io bo@uical oy Wie cou process cause disruption of production Leak in eMlucnt aircooler HDT | x_[§ [ One tube fais Hi alaroer Glass B | Release of het water, deavator, XA | In case no spare capacity this ay hans a steam ér ‘more serious effects | Release of “cold” Chide oil. eg Pre | x) B | Production laws i |= |= | MenaaiacapeaEner| Pea Fouling of Equipment: Tanks, | & [B | Production Loss Desalicr, HE | Minor Release oF el products below | x | x | Flange lealape piuloks 3 faci | 5 GGA | Reese wereooTng way |S] =] Ny Wego SSE lube ar creed Kani Spare/naruing systern, Possibly poissonous rele It fo environmentS10? Materials & Cerrsion Enginesrng Haraven Catan Si: Workshen 1906 24.2 Ranking of Likelihood (of a failure) hen determining the ikelihood itis proposed 19 make a similar table as table 2. Hic ts divided inthe S likelihood categories as dcpicted in the criticality matrix Table 2. Ranking of Likelihood Note: The table below is intended as'an example enly (las | Likelyhood of Degradation Mechaniany | Reams rae Class | Potential of rapid unprediciable stress ‘When high tensile carbon seals are used 5 | corrosion cracking leading to failure, ‘with improper welding procedures oF tine H2S- sce of sicel > 248HY controlled weld repair Liquid Zine Attack of Stainless sice Restarting after fire. welding on Zasparnted (wider fire or welding conditions) steel. SCC in solid stainless stel pipe. C-PA-— | Note that the consequence of Ins TAIINe se ofien limited, savall ho Rapid general corrosion of unknown Ta case unaware corrosiveagenis can corrosion processes. concentrate in tie unit rapi¢ corrosion might ‘occur. €.8 chlovides inn HDT units Plants designed/revamped without proper | Uncontrolled hardness of welds, weld applications of standards and design defects, material defects and ucknown codes, ductility may teac 10 failure. After material 7 checks possibly dows to Class 2 or 3 “ Mercury tapped in a system with copper- | Mercury is difficult te waee and get oun T alloys. (Gas treating, ex FCCU). ‘causes stiess cracking ia Cy-lloys Application of mercusy trap can eliminate the problem Class | Corrosion under unknown corvosive OVHDs of CDUs of unatable operated wits 4 | conditions or strongly variing process Units with no control on feedstock wri conditions, corrosives. Covresion under deposils of aggressne | Nasty, high covvecion ales calling puNOISS salts of NEB. ‘Caustic Cracking Overdosing in CDUs Mechanism not fully prediciable, ded T-ppHD is above the CS ran; ‘of Nelson Graphs) Class 5 with more frequent or selecive | More andlor seeing Inepesioi Tauce inspection Shorter intervals will increase the possibility {9 find defects. Noten! valid in all cases Glass | Contoaon assed by Tow i iknow | Sulphaton elon NASD 3) | flow conditions. when a0 good tention ts | eoreven sills bergen ow and eorrsion sate Corrosion-fatigue Difficult to predict as fhilure may far below ax ses contition Failgic of sal bore nozales Allvibrating small bare and SIEGE connections are in orieipie prone 2 Class 5 with extended inspecion More and/or stetive inspection, Tse g Shorter interval wll icicace the passiiy 3 | otnd defenis Note nor vatidn there Tiquid Zc Atak of Stalnieesiest | Welding on gaooncr se small cracks leading 1o leakage arate of (205 Depending on corrosion allow ange En,Poe XN ‘IOP Materials & Coresion Enginaering defined and known corrosion rate relation. Class | Pitng attack with low pitting rate02] Eg general pitingal Gurbon Al Ws COU 2 | move e-heat trains Corresion dat can strongly vary ‘Most aqueous coriosion phenomena in depending on process conditions but CDUs and oil storage limited maximum corrosion rate potential of 0.5 mmr Cinss 3 and + with more and proper More and/or selective inspection, Henee inspection shoricr intervals will increase the possibility to Gnd defects, Nole: not valid in aff ensos Class | Uniform corrosion of any rate under well Sulphidation, dean seam reaction boilers. Oxidation of gas fired ‘Any more or less known corrosion with a ‘known very low rate of less than 0.05 mms Weaihening, Class ind 2 with selective inspection Note: For the likelihood it is not im be taken in to 2c: sportant ifthe leak is large or small as the size of the leak shall count when the Consequences is determined (able 1), The likelihood" is the same for HSE and CAP, hence there are extra columns here, un Carden S-Workshos 1595%& SIOP Matera Ceration Enginating Mareren Cardon Workshop 1956 28 Flowcharts and Tools for assistance In addition to the atove tables, fowchart criticality ‘and tables may also help to stricture and rank Flowchart 1: Primary Evaluation of Plant In this flowchart its checked ifthe plant fulis basic design requiremeats and ifthe plant is still in 2 good condition, Tacir should be evidence inthe form af eg inepection Feports stating the Sicrent condition of equipment and is history. Absence of records and/or non complisnes With esign standards will require an adeitional investigation-evaluation, This could contin of material checks by means of metallograhic examinations and or hardness checks. verification of wet ign standard and quality of the consinsetion work. Primary Evaluation Teh + Int + Loe ‘Standards pplied for Design? Banas free # Wei Guatty Weld Procedures Evaluate Extra Risks Plant Concition ox? Continue With “Degradation Likelihood’ Flow Chart DerineSIOP Meteies & Coveson Engineering Carson Si.Werkshes 1296 Flowchart 2: Bow-tie Model Likelihood & Consequence Model Bowtie Model x OCDENES omozmcemozgq {The Bow-tie model describes "what it needs to make things to occur”. Reading the bowtie from eB to right: |. their need to be hazards, eg, risk of unwanted release ofa liquid or substance 2. their arc one or mere threats that may make it happen; corrosion, facta their are barriers which make it more dificult to let it happen: safes corrosion allowances, material bends rather then fractures despite the barriers the event will take place, are their means that can contain the event (carly warning, fite fighting. second containment. , ignition does not occur, ete.) takea all the previous things into account what ace finally the conseaus sin design, 4 weSIOP Natenais & Conosien Engineering Macaven Cardon St.Wotksnop ir Son sn Flowchart 4. Likelihood of Corrosion and Degradation, Flowchart 4 provides some guidanee for likelihoad of corrosion, It should be noted that the Ficticiabilty of “general cortosion” may be very good, hence will score lon an Ukeliiood but that the consequence may be much more severe than from piling which hee gh likeliheod and low a's of Predictability. A pit will sult in a small hole while oneral eorrorson at Pips or vessel imei a in general wall thinning and 2 full collapse. Some classes like brite Tene ae in detail defined, but the likclihocd/predictability ones consid, Predictability Possible is high because of low Flowchart 4, DEGRADATION Likelihood le Factors Oster Lassie Legend: *Precicabiiy Cass Oe Sok re 3 Se , ~ Hote: Fitting is less predictable hones Liklinood to occur is larger However failure due to general corrosion may cause 2 touch larger HOLE! Note: PC x = Predictability Class "x"!sired Maraven Cardon SIaWorkshop 1965 SIOP Mateiats & Conasion Flowcharts 3 and 8: Consequence of Failure; Release of Process Medium The following flowcharts are based on the contents ofthe sysiom: © Release Volume and Rate Liguified gas Gas Flammable Liquids Non-Flammable Liquids ay Flash =very hel) to ignite Cacao) ew Besson dant \Vrel= Releasabie Liquid or 932 from Vessel Escalation ic only essumed where questioned Flowchart 3B: No major cscalation is inthis chart 3b assumed provided it is mentioned in the in the decision bos Table 3: Consequence of Failure; Production Loss and HSE. Table 3: Main Consequence Categori | Rating | Health - People Costs in USS | Production Loss Class A | Light Injuryfillness | = 30.000 sw hoor (Minor) Class B | Minor Injuries 300.0000 <2aays (Moderate)_| Low severity LTL Class | Major Injury(s) = 5000000 <2 wks (Serious) | Partial disability High severity LTL Class Single Fatality, <30.000000 | <2 month (Major) _| Permanent Disabled ClassE | Mukiple Fatalities | >30.000.000 | >2monh (Catastrophic) Note: When considering Considered to determi: Also multiple outage be Production loss.) reduction loss, knock-on effects in other plants shall also be the overall severity. This effeet can be more severe then the event itself. se of the Same teason can result ina higher severity (cumulativeSIOP tetenais & Coneson Ensinaering sraven Carden Si-Werksnap 1996 Table 4: Severity Risk Estimator Matrix The following provides a very qualitartive estimator for risk and consequence Severity Risk Estimator Matrix Consequence Rating & Type | Increasing Likeliha, > [SE 3 I¢ Neer |Hewd inde | lapaw ned for fics | aac | otis | tacice | meso i the | ia (oa Company wots | indict, | Rating | People | assets | envio | image 0 [xe [xe [xe [we Heret [tages {ings | = A ‘Stight ‘Slight Slight | Slight 7 toy | Danaze | nga [imax | P| rove | by |Proced | ures B Miner ‘Minor Minor a Injure topset_| tmpat © | Maer Locale | Cons | i z Iajey a [abt Inoeet_| ings D ‘Single Major | Major Fatality Inpact_| Naot E | Map Massive re Fatalities