Safety, Health, and Environment · Study · FE Chemical · FE → PE Prep
Safety, Health, and Environment
5% of exam
Hazardous material properties and safety data sheets, industrial hygiene (toxicity, noise, PPE, ergonomics), process safety and hazard analysis (LOPA, HAZOP, fault and event trees, dispersion modeling), overpressure and underpressure protection (relief and inherently safer design), waste minimization, treatment, and regulation (RCRA, CWA, EPA, OSHA), and reactivity hazards (inerting, runaway reactions, compatibility).
4 concepts
A. Hazardous properties of materials, including SDS
Material Hazards, Flammability and Industrial Hygiene
Read flash point, autoignition and LFL/UFL off an SDS, rate hazards with the NFPA diamond, apply TLV/PEL limits, and add noise on the decibel scale.
Unlocks with an access pass — one-time payment, no auto-renew. View passes
Pass holders
C. Process safety, risk assessment, and hazard analysis
Process Safety: HAZOP, LOPA and Risk Assessment
Generate deviations with HAZOP guide words, multiply independent-protection-layer PFDs in LOPA, and combine fault- and event-tree gates with the AND-multiply, OR-add rules.
Process safety is where chemical engineering stops being about yield and starts being about preventing the low-probability, high-consequence event — the runaway, the toxic release, the vapor-cloud explosion. The discipline is structured: HAZOP finds the deviations, LOPA counts whether enough independent barriers stand between an initiating event and an intolerable consequence, and fault/event trees put numbers on the combinations. The FE Reference Handbook — Safety section frames risk as Risk=Hazard×Probability, and every method in this concept is a disciplined way of estimating one side of that product. The exam-critical reflex is Boolean: redundant (parallel) failures (an AND gate, all must fail) multiply, while series failure paths (an OR gate, any one suffices) add. Confuse the two and the answer is off by orders of magnitude.
HAZOP: guide words crossed with parameters
A Hazard and Operability study walks a process node by node and systematically multiplies a set of guide words against each process parameter to force the team to imagine every credible deviation. The guide words — NO/NONE, MORE, LESS, AS WELL AS, PART OF, REVERSE, OTHER THAN — cross with parameters like flow, pressure, temperature, level, and composition. 'MORE pressure' on a reactor node prompts the team to ask what raises it, what consequence follows, and what safeguard exists. The power of HAZOP is completeness: it is a structured brainstorm that exposes scenarios a checklist would miss, and it feeds the candidate scenarios that LOPA then quantifies.
Deviation=Guide word×Process parameter
Independent protection layers
An Independent Protection Layer (IPL) is a safeguard that is effective in preventing the scenario from reaching its consequence, independent of the initiating cause and of the other layers, and auditable. The onion model stacks them outward from the process: inherent design, the basic process control system (BPCS), critical alarms with operator response, the safety instrumented system (SIS/interlocks), physical relief (relief valves, rupture disks), then dikes, and finally emergency response. Each genuine IPL earns credit only if it is truly independent — a sensor shared between the BPCS control loop and an alarm is one layer, not two — which is the single most-tested judgment in LOPA.
LOPA: multiplying PFDs
Layer of Protection Analysis is a semi-quantitative bridge between a qualitative HAZOP and a full fault tree. The mitigated event frequency is the initiating-event frequency multiplied by the probability of failure on demand (PFD) of every independent protection layer that can stop the scenario. Because the layers are independent, their PFDs multiply: two layers each with PFD=0.1 give a combined demand-failure probability of 0.01, a hundred-fold reduction. You then compare the mitigated frequency to a tolerable target (often 10−4 to 10−6
PFD, risk reduction factor and SIL
The probability of failure on demand is the fraction of demands on a safety function that it fails to answer; its reciprocal is the Risk Reduction Factor, RRF=1/PFD. A safety instrumented function is graded by Safety Integrity Level: SIL 1 spans PFD from 10−1 to 10−2
Fault trees and event trees
A fault tree works backward from a single top event (the loss of containment) through Boolean gates to its basic causes. An AND gate fires only if all inputs fail, so the top probability is the product of the input probabilities; an OR gate fires if any input fails, so for small, independent probabilities the top probability is approximately their sum (exactly 1−∏(1−pi)). An event tree works the other direction: it starts from an initiating event and branches success/failure at each safeguard, multiplying along each path to assign a frequency to every outcome. Together they let you trace a number from root causes through to consequence likelihood.
PAND=i∏pi,POR=1−i∏(1−pi)≈i∑pi
Consequence and dispersion basics
The consequence side of risk estimates how far harm reaches. A neutrally buoyant continuous ground-level release disperses by a Gaussian-plume model in which the centerline downwind concentration falls as the source strength divided by the wind speed and the spreading parameters σy,σz — concentration is inversely proportional to wind speed, so a calm day is the worst case (an elevated source adds a exp(−H2/2σz2)
Exam strategy
Decide the gate first: 'all of these must fail' is AND (multiply), 'any one of these fails' is OR (add for small probabilities). In LOPA, list only genuinely independent layers — strike any that shares a sensor, logic solver, or final element with another — then multiply their PFDs by the initiating frequency. Compare the result to the tolerable target and, if short, divide to get the required RRF and read off the SIL. Keep frequencies (per year) distinct from probabilities (dimensionless per demand): the initiating event is a frequency, each IPL contributes a dimensionless PFD, and their product is again a frequency.
Key equations
Risk definitionRisk=Hazard×Probability
Risk combines the inherent capacity to harm with the likelihood (and severity) of the harmful event.
HAZOP deviationDeviation=Guide word×Parameter
Worked examples
LOPA layer count and SIL selection
Problem. A loss-of-cooling initiating event occurs at finit=0.1yr−1. Two independent protection layers exist: a high-temperature alarm with operator response (PFD=0.1
Common pitfalls
•Swapping the gate rules: AND (all must fail, redundancy) multiplies probabilities; OR (any one fails, series) adds them. Reversing the two changes the answer by orders of magnitude.
•Counting non-independent layers as separate IPLs — two functions sharing a sensor, logic solver, or final element are not independent and earn credit for only one layer.
•Mixing frequencies and probabilities: the initiating event is a frequency (per year), each IPL contributes a dimensionless PFD, and only their product is again a frequency.
•Adding PFDs instead of multiplying them in LOPA — independent layers multiply, so two PFD=0.1 layers give 0.01, not 0.2
References
NCEES FE Reference Handbook — Safety
CCPS (AIChE), Guidelines for Hazard Evaluation Procedures and Layer of Protection Analysis
IEC 61511 Functional Safety — Safety Instrumented Systems for the Process Industry
D. Overpressure and underpressure protection
Overpressure Relief and Reactivity Hazards
Set relief pressure against MAWP and accumulation, size for the worst credible scenario, inert to dodge the flammable range, and bound runaway reactions with adiabatic temperature rise.
Unlocks with an access pass — one-time payment, no auto-renew. View passes
Pass holders
E. Waste minimization, waste treatment, and regulation
Waste Minimization, Treatment and Environmental Regulation
Climb the waste hierarchy from source reduction to treatment, compute series removal efficiency, classify generators under RCRA, and place CWA, CAA and OSHA correctly.
Unlocks with an access pass — one-time payment, no auto-renew. View passes
Pass holders
/yr depending on consequence severity); if the gap remains, you add a layer — typically a safety instrumented function of the required SIL.
fmitigated=finitiating×j∏PFDj
(RRF
10
–
100
), SIL 2 from
10−2
to
10−3
, SIL 3 from
10−3
to
10−4
. When LOPA leaves a residual gap of, say, a factor of
100
between the mitigated frequency and the tolerable target, you specify a function whose RRF closes it — here a SIL 2 interlock with
factor at ground level). Toxic endpoints are tied to ERPG/AEGL thresholds, flammable endpoints to the LFL contour, and overpressure to TNT-equivalent blast curves. For the FE the key qualitative points are that heavier-than-air gases slump and travel low, releases are worst in stable, low-wind conditions, and consequence times probability gives the risk you compare against tolerability.
Multiply the initiating frequency by the branch probability (success or failure) along each path.
Gaussian plume centerlineC=πuσyσzm˙
Ground-level downwind concentration for a continuous neutral release; inverse in wind speed u — calm air is worst case.
) and a BPCS-based trip (
PFD=0.1
). The tolerable frequency for this consequence is
1×10−5yr−1
. Is the protection adequate, and if not, what SIL interlock is required?
Solution. Mitigated frequency with the two existing layers:
fmit=0.1×0.1×0.1=1×10−3yr−1.
Compare to tolerable: the gap factor is 1×10−3/1×10−5=100, so the existing layers fall short by 100×.
Required added PFD=1×10−5/1×10−3=0.01, i.e. RRF=100 — a SIL 2 safety instrumented function.
Sanity check: adding a PFD=0.01 layer gives 1×10−3×0.01=1×10−5yr−1, exactly the target.
fmit=0.1×0.1×0.1=10−3yr−1⇒add PFD≤0.01
Fault tree with AND and OR gates
Problem. A reactor overpressures if its relief path fails. The relief path fails only if both a relief valve (p1=0.02) and a rupture disk (p2=0.05) fail (AND). Separately, a control failure (p3=0.01) can also cause overpressure (OR, combined with the relief-path failure). Find the top-event probability.
Solution. Redundant relief is an AND gate: Prelief fail=p1p2=0.02×0.05=1.0×10−3
Ptop=1−(1−p1p2)(1−p3)≈1.10×10−2
Required risk reduction factor
Problem. An unmitigated scenario has frequency 2×10−1yr−1 and the tolerable frequency is 1×10−4yr−1. What total risk reduction factor must the protection layers supply, and could two SIL 1 layers achieve it?
•Confusing RRF and PFD: RRF=1/PFD, so a larger RRF means a smaller (better) PFD; an RRF=100 layer is SIL 2.
•Assuming the windiest day is worst for a toxic plume — centerline concentration is inversely proportional to wind speed, so calm, stable air gives the highest concentrations.
•Treating HAZOP as quantitative — it generates and screens deviations qualitatively; LOPA or a fault tree supplies the numbers.
.
The two independent ways to overpressure combine in an OR gate:
Ptop=1−(1−1.0×10−3)(1−0.01)=1.099×10−2≈1.10×10−2
.
The small-probability approximation
Ptop≈1.0×10−3+0.01=0.011
agrees to three figures.
Sanity check: the AND gate (redundancy) drove the relief-path failure down to
10−3
, while the single control failure at
10−2
dominates the OR sum — the larger contributor controls, as expected.
.
Two SIL 1 layers each give
RRF
between
10
and
100
, so together
100
to
10,000
. At the low end (
10×10=100
) they fail; only if each approaches
RRF≈45
or more (so the product
≥2,000
) do they suffice.
Sanity check:
2,000
corresponds to a combined
PFD=5×10−4
, achievable by two strong SIL 1 layers or one SIL 1 plus one SIL 2 — consistent with the SIL bands.